A. The host operating system logs in the audit information
B. Logs includes logins,file opens and program executions
C. Logs are analysed to detect tails of intrusion
D. All of the mentioned

A. Buffer overflows
B. Unexpected combinations and unhandled input
C. Race conditions
D. All of the mentioned

A. Analysis engine
B. Event provider
C. Alert database
D. All of the mentioned

A. Zone based
B. Host & network based
C. Network & zone based
D. Level based

A. It models the normal usage of network as a nosie characterization
B. It doesn’t detect novel attacks
C. Anything distinct from the nosie is not assumed to be intrusion activity
D. It detects based on signature

A. These are very slow at detection
B. It generates many false alarms
C. It doesn’t detect novel attacks
D. None of the mentioned

A. Most are based on simple pattern matching algorithms
B. It is programmed to interpret a certain series of packets
C. It models the normal usage of network as a nosie characterization
D. Anything distinct from the nosie is assumed to be intrusion activity

A. They are unable to detect novel attacks
B. They suffer from false alarms
C. They have to be programmed again for every new pattern to be detected
D. All of the mentioned

A. Unselective logging of messages may increase the audit burdens
B. Selective logging runs the risk of missed attacks
C. They are very fast to detect
D. They have to be programmed for new patterns

A. Attack verification
B. System specific activity
C. No additional hardware required
D. All of the mentioned