Chapter 8 – Intrusion Detection and Prevention Systems
TRUE/FALSE
1. An IDPS consists of a single device that you install between your firewall and the Internet.
2. A weakness of a signature-based system is that it must keep state information on a possible attack.
3. No actual traffic passes through a passive sensor; it only monitors copies of the traffic.
4. An NIDPS can tell you whether an attack attempt on the host was successful.
5. A hybrid IDPS combines aspects of NIDPS and HIDPS configurations.
MULTIPLE CHOICE
1. Which of the following is NOT a network defense function found in intrusion detection and prevention
systems?
a.
prevention
c.
identification
b.
response
d.
detection
2. Which of the following is NOT a primary detection methodology?
a.
signature detection
c.
anomaly detection
b.
baseline detection
d.
stateful protocol analysis
3. The period of time during which an IDPS monitors network traffic to observe what constitutes normal
network behavior is referred to as which of the following?
a.
training period
c.
profile monitoring
b.
baseline scanning
d.
traffic normalizing
4. What is an advantage of the anomaly detection method?
a.
makes use of signatures of well-known
attacks
c.
easy to understand and less difficult to
configure than a signature-based system
b.
system can detect attacks from inside the
network by people with stolen accounts
d.
after installation, the IDPS is trained for
several days or weeks
5. Which approach to stateful protocol analysis involves detection of the protocol in use, followed by
activation of analyzers that can identify applications not using standard ports?
a.
Protocol state tracking
c.
Traffic rate monitoring
b.
IP packet reassembly
d.
Dynamic Application layer protocol
analysis
6. Which of the following is an advantage of a signature-based detection system?
a.
the definition of what constitutes normal
traffic changes
c.
each signature is assigned a number and
name
b.
it is based on profiles the administrator
creates
d.
the IDPS must be trained for weeks
7. Which method for detecting certain types of attacks uses an algorithm to detect suspicious traffic, is
resource intensive, and requires extensive tuning and maintenance?
a.
brute force
c.
signature
b.
heuristic
d.
anomaly
8. Which of the following is NOT a typical IDPS component?
a.
network sensors
c.
database server
b.
command console
d.
Internet gateway
9. Where is a host-based IDPS agent typically placed?
a.
on a workstation or server
c.
between remote users and internal
network
b.
at Internet gateways
d.
between two subnets
10. Which IDPS customization option is a list of entities known to be harmless?
a.
thresholds
c.
blacklists
b.
whitelists
d.
alert settings
11. Which of the following is considered a problem with a passive, signature-based system?
a.
profile updating
c.
custom rules
b.
signature training
d.
false positives
12. Which type of IDPS can have the problem of getting disparate systems to work in a coordinated
fashion?
a.
inline
c.
hybrid
b.
host-based
d.
network-based
13. Which of the following is NOT a method used by passive sensors to monitor traffic?
a.
spanning port
c.
packet filter
b.
network tap
d.
load balancer
14. Which of the following is a sensor type that uses bandwidth throttling and alters malicious content?
a.
passive only
c.
active only
b.
inline only
d.
online only
15. Which of the following is true about an HIDPS?
a.
monitors OS and application logs
c.
tracks misuse by external users
b.
sniffs packets as they enter the network
d.
centralized configurations affect host
performance
16. Which of the following is true about an NIDPS versus an HIDPS?
a.
an NIDPS can determine if a host attack
was successful
c.
an HIDPS can detect intrusion attempts on
the entire network
b.
an HIDPS can detect attacks not caught by
an NIDPS
d.
an NIDPS can compare audit log records
17. Which of the following is an IDPS security best practice?
a.
to prevent false positives, only test the
IDPS at initial configuration
c.
all sensors should be assigned IP
addresses
b.
communication between IDPS
components should be encrypted
d.
log files for HIDPSs should be kept local
18. If you see a /16 in the header of a snort rule, what does it mean?
a.
a maximum of 16 log entries should be
kept
c.
the subnet mask is 255.255.0.0
b.
the size of the log file is 16 MB
d.
the detected signature is 16 bits in length
19. Why might you want to allow extra time for setting up the database in an anomaly-based system?
a.
the installation procedure is usually
complex and time consuming
c.
it requires special hardware that must be
custom built
b.
to add your own custom rule base
d.
to allow a baseline of data to be compiled
20. Which of the following is true about the steps in setting up and using an IDPS?
a.
anomaly-based systems come with a
database of attack signatures
c.
alerts are sent when a packet doesn’t
match a stored signature
b.
sensors placed on network segments will
always capture every packet
d.
false positives do not compromise
network security
COMPLETION
1. Anomaly detection systems make use of _______________ that describe the services and resources
each authorized user or group normally accesses on the network.
2. In a _______________ based detection system, the IDPS can begin working immediately after
installation.
3. An IDPS __________________ server is the central repository for sensor and agent data.
4. A network ____________ is a type of passive sensor that consists of a direct connection between a
sensor and the physical network medium.
5. __________________ procedures are a set of actions that are spelled out in the security policy and
followed if the IDPS detects a true positive.
MATCHING
a.
accountability
f.
passive sensor
b.
escalated
g.
profiles
c.
event horizon
h.
sensor
d.
inline sensor
i.
stateful protocol analysis
e.
intrusion
j.
true positive
1. an attempt to gain unauthorized access to network resources
2. the entire length of an attack
3. a genuine attack detected successfully by an IDPS
4. an NIDPS sensor positioned so that all traffic on the network segment is
examined as it passes through
5. an IDPS component that monitors traffic on a network segment
6. increasing an intrusion response to a higher level
7. sets of characteristics that describe network services and resources a user or group normally accesses
8. the process of maintaining a table of current connections so that abnormal traffic can be identified
9. the ability to track an attempted attack or intrusion back to its source
10. an NIDPS sensor that examines copies of traffic on the network
SHORT ANSWER
1. What are the three network defense functions performed by an IDPS?
2. Contrast anomaly detection with signature detection.
3. Describe two advantages and two disadvantages of an anomaly-based system.
4. Describe two advantages and two disadvantages of a signature-based system.
5. Define stateful protocol analysis. Include in your answer the concept of the event horizon.
6. List two approaches to stateful protocol analysis.
7. What are the four typical components of an IDPS?
8. What are the four common entry points to a network where sensors should be placed?
9. What is an inline sensor and how is it used to stop attacks?
10. List four types of information that an NIDPS typically logs.