Sscp Infosec - Monitoring And Analysis

Front 1

Name 4 type of IDS.

Back 1

Passive IDS
> NIDS - Networked-based IDS
> HIDS - Host-based IDS
Active IDS
> NIPS - Networked-based IPS
> HIPS - Host-based IPS

Front 2

How is HIDS provided?

Back 2

HIDS software is installed on each server and workstation.

Front 3

How is NIDS provided?

Back 3

NIDS uses a Management server on an internal segment.
NIDS agents are located on network devices and are located on different network segments.

Front 4

An IDS triggers an alert when an event reaches a specific threshold.
TRUE or FALSE?

Back 4

TRUE.
There is no magic number to set your threshold at but most admins would rather have some false positives rather than be under attack without knowing about it.

Front 5

NIDS agents (or nodes) monitors the traffic and reports its finding to where?

Back 5

NIDS management server.

Front 6

There are 3 drawbacks associated with HIDS. What are they?

Back 6

1.) Software is very processor-intensive.
2.) It can be quite expensive to install on all hosts.
3.) Manay attackers can detect a HIDS, then disable it or erase the HIDS logs.

Front 7

Installing HIDS on each system protects against an attack launched where?

Back 7

Internally!
Protects from an internal attacker or
From malware released on the internal network.

Front 8

IPS has the capability of modifying the ACL on a router for what reason?

Back 8

To block attacks or take other steps to close the connection .
Example: If a port scan is detected from a specific IP address, the IPS can modify the router so that the port scan is blocked.

Front 9

What can an IPS do if it detects a SYN flood attack?

Back 9

The IPS can detect this attack and not only block any more traffic from the attacker, it can also close all the half-open connections on the targeted servers.

Front 10

There are 3 types of detection methods for all IDSs and IPSs. What are they?

Back 10

1.) Signature-based
2.) Anomaly-based
3.) Hybrid of the 2

Front 11

Signature-based detection method is also called what?

Back 11

Knowledge-based detection
This method is similar in concept to AV signatures.
Both the vendor supplying the IDS and the organization using the IDS must update these signature files regularly to detect newer attacks.

Front 12

Anomaly-based systems can go by many names. Name 2 other names.

Back 12

1.) Behavior-based
2.) Heuristics-based

Front 13

What is the disadvantage of an anomaly-based system compared to signature-based system?

Back 13

It often has a higher level of false positives than a signature-based system.

Front 14

What can an Anomaly-based system do?

Back 14

Ti can attempt to document normal behavior in the form of a baseline. If the current activity differs significantly from the baseline, the IDS/IPS will issue an alert to the activity.

Front 15

What detection method can be used as an alternative to HIDS and HIPS?

Back 15

Whitelisting
The application whitelist identifies approved software.
Any software that attempts to run but is not on the list is blocked.

Front 16

How can IDS support Integrity?

Back 16

One of the ways that an IDS can detect an attack is by detecting unauthorized changes.

Front 17

What method is used on many IDSs and Antivirus applications to detect unauthorized changes to critical system files?

Back 17

Hashing techniques can detect such changes.

A File Integrity Checker calculates hashes on files to establish a baseline. If the hashes are modified, it detect the change and sends an alert.

Front 18

What is SEM?

Back 18

System Event Manager

Front 19

What is SIM?

Back 19

Security information Management

Front 20

What is SIEM?

Back 20

Security information and event management

Front 21

If an organization must comply with specific laws, a SEM could have components to monitor systems for compliance with the laws and report if a system is no longer compliant.
TRUE or FALSE

Back 21

TRUE

Front 22

Many organizations perform regular security assessments. The most common type of security assessment is what?

Back 22

Vulnerability assessment.

Note: Security audits is also a form of a security assessment.

Front 23

Vulnerability assessments can be classified based on the individuals performing the test. What 3 type of tests can be used?

Back 23

1.) White box or internal testing - Full Knowledge
2.) black box or external testing - Zero Knowledge
3.) Gray box testing - - Partial knowledge
Testers have at least some level of knowledge about the network.

Front 24

A log scrubber is a process that examines applications and system logs for evidence of system misuse. What detection method is used?

Back 24

HIDS

Front 25

A log management infrastructure typically is comprised of what three components?

Back 25

1.) Log Generation
2.) Log Analysis and Storage
3.) Log Monitoring

Front 26

The Steps for processing events in SEMS are what?

Back 26

1.) Parsing
2.) Categorization
3.) Prioritization
4.) Aggregation

Front 27

Which of the following are indicators of security-centric log entries?
I. System Hardware and Software errors
II. Low-level host information
III. Database checkpoint record
IV.High-level host information

1.) I and III
2.) I, II, and IV
3.) I, II, and III
4.) II and III

Back 27

2.) I, II, and IV

Front 28

What best identifies what is found in an audit log entry?

Back 28

1.) Who
2.) What
3.) When
4.) Where

Front 29

A vulnerability assessment scanned a system and did not report any vulnerabilities. However, you know that the system is vulnerable because it does not have a specific patch installed.
What is this called?
A.) A false positive
B.) A false negative
C.) A penetration test failure
D.) A penetration test success

Back 29

B.) A false negative