Which of the following monitors network traffic in real time?
Answer(s): A
This type of IDS is called a network-based IDS because monitors network traffic in real time.
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 48.
A host-based IDS is resident on which of the following?
A host-based IDS is resident on a host and reviews the system and event logs in order to detect an attack on the host and to determine if the attack was successful. All critical serves should have a Host Based Intrusion Detection System (HIDS) installed. As you are well aware, network based IDS cannot make sense or detect pattern of attacks within encrypted traffic. A HIDS might be able to detect such attack after the traffic has been decrypted on the host. This is why critical servers should have both NIDS and HIDS.FROM WIKIPEDIA:A HIDS will monitor all or part of the dynamic behavior and of the state of a computer system. Much as a NIDS will dynamically inspect network packets, a HIDS might detect which program accesses what resources and assure that (say) a word-processor hasn\'t suddenly and inexplicably started modifying the system password-database. Similarly a HIDS might look at the state of a system, its stored information, whether in RAM, in the file-system, or elsewhere; and check that the contents of these appear as expected.One can think of a HIDS as an agent that monitors whether anything/anyone - internal or external - has circumvented the security policy that the operating system tries to enforce. http://en.wikipedia.org/wiki/Host-based_intrusion_detection_system
Which of the following usually provides reliable, real-time information without consuming network or host resources?
A network-based IDS usually provides reliable, real-time information without consuming network or host resources.
The fact that a network-based IDS reviews packets payload and headers enable which of the following?
Because a network-based IDS reviews packets and headers, denial of service attacks can also be detected.This question is an easy question if you go through the process of elimination. When you see an answer containing the keyword: ALL It is something a give away that it is not the proper answer. On the real exam you may encounter a few question where the use of the work ALL renders the choice invalid. Pay close attention to such keyword.The following are incorrect answers:Even though most IDSs can detect some viruses and some password guessing attacks, they cannot detect ALL viruses or ALL password guessing attacks. Therefore these two answers are only detractors.Unless the IDS knows the valid values for a certain dataset, it can NOT detect data corruption.
Which of the following reviews system and event logs to detect attacks on the host and determine if the attack was successful?
A host-based IDS can review the system and event logs in order to detect an attack on the host and to determine if the attack was successful.
Post your Comments and Discuss ISC SSCP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SSCP content, but please register or login to continue.