Intrusion Detection Systems Overview Answers 1. What is the primary function of an Intrusion Detection System (IDS)? A. Encrypt sensitive data B. Monitor and log network traffic C. Actively block suspicious traffic D. Generate firewall rules Answer: Monitor and log network traffic (B) An IDS passively monitors and logs detected activities and events, serving as a detection tool. 2. Which aspect is crucial when deploying an IDS in terms of network architecture? A. Vendor reputation B. Network topology and structure C. User training sessions D. Cost of implementation Answer: Network topology and structure (B) The deployment of an IDS largely depends on the network topology, determining where it should be placed. 3. What distinguishes an Intrusion Prevention System (IPS) from an IDS? A. IDS can defend against malware, but IPS cannot B. IPS is often deployed inline, while IDS is monitoring-only C. IPS uses signature updates more frequently than IDS D. IPS passively logs data while IDS actively blocks Answer: IPS is often deployed inline, while IDS is monitoring-only (B) An IPS is deployed inline and actively blocks malicious traffic, whereas an IDS typically operates in a monitoring mode. 4. What is a significant limitation of IDS that organizations must manage? A. Dependency on external software integration B. Risk of evasion techniques by sophisticated attackers C. Accuracy in detecting legitimate traffic D. Cost of implementation and maintenance Answer: Risk of evasion techniques by sophisticated attackers (B) Sophisticated attackers may employ evasion techniques that challenge the effectiveness of IDS systems. 5. How can organizations minimize the issue of false positives in IDS? A. Refine and tune the detection algorithms B. Increase the number of alerts C. Deploy multiple IDS solutions D. Enhance signature update frequency Answer: Refine and tune the detection algorithms (A) Careful tuning and refining of detection systems is crucial in reducing the number of incorrect alerts in IDS. 6. Which of the following factors should be considered when evaluating and selecting an IDS? A. Marketing strategies used by vendors B. Vendor budget estimates C. Scalability for future growth D. Employee background checks Answer: Scalability for future growth (C) Scalability is important to ensure that the IDS can efficiently handle increased data volume and network growth. 7. What role does alerting play in an IDS? A. Automatically block malicious traffic B. Notify administrators of potential intrusions C. Determine the cost of network resources D. Generate detailed reports on user behavior Answer: Notify administrators of potential intrusions (B) The alerting system generates alerts that inform administrators of potential intrusions along with relevant details about the threats. 8. What should an organization align with their IDS for enhanced protection? A. Established security policies and procedures B. Software licensing agreements C. External hardware requirements D. Personal goals of employees Answer: Established security policies and procedures (A) Aligning the IDS with the organization's security policies helps improve its effectiveness and appropriateness. 9. Which type of Intrusion Detection System monitors individual computer systems? A. Cloud-based Intrusion Detection System B. Hybrid Intrusion Detection System (HIDS/NIDS) C. Host-based Intrusion Detection System (HIDS) D. Network Intrusion Detection System (NIDS) Answer: Host-based Intrusion Detection System (HIDS) (C) HIDS focuses on monitoring activities on individual hosts rather than network traffic. 10. What is a key disadvantage of signature-based detection methods in IDS? A. It generates too many false positives B. It can only detect known attacks and may miss new threats C. It is slow and inefficient in processing D. It cannot analyze network traffic in real-time Answer: It can only detect known attacks and may miss new threats (B) Signature-based detection relies on known signatures, making it ineffective against new or unknown threats. 11. What component of an IDS is responsible for detecting and collecting potential intrusions? A. Analyzer/Engine B. Sensor C. Controller/Manager D. Firewall Module Answer: Sensor (B) The sensor is crucial for gathering data to analyze for potential intrusions. 12. How does anomaly-based detection identify suspicious activities? A. By redirecting suspicious activities to a secure server B. By examining packet structures for known signatures C. By comparing activities against historical performance standards D. By blocking all incoming traffic that matches known patterns Answer: By comparing activities against historical performance standards (C) Anomaly-based detection works by identifying deviations from the established norm of normal activity. 13. In which location can Intrusion Detection Systems (IDS) be deployed? A. At network periphery, host systems, and in the cloud B. Exclusively at the network perimeter C. Only within the cloud D. Only on individual computers Answer: At network periphery, host systems, and in the cloud (A) IDS can be deployed in multiple locations to enhance security monitoring. 14. What is the risk associated with anomaly-based detection in an IDS? A. It may produce false alarms due to unexpected normal conditions B. It can only function effectively in large networks C. It has no method to update detection algorithms D. It relies heavily on historical data which may be outdated Answer: It may produce false alarms due to unexpected normal conditions (A) Anomaly-based detection can lead to false positives when unexpected behavior is interpreted as suspicious. 15. Which component of an IDS is responsible for processing data to detect suspicious activities? A. Network Gateway B. Sensor C. User Interface D. Analyzer/Engine Answer: Analyzer/Engine (D) The analyzer or engine processes data from the sensors to identify potential threats.