In the process of gathering evidence from a computer attack, a system administrator took a series of actions which are listed below. Can you identify which one of these actions has compromised the whole evidence collection process?
Answer(s): D
Displaying the directory contents of a folder can alter the last access time on each listed file.Using a write blocker is wrong because using a write blocker ensure that you cannot modify the data on the host and it prevent the host from writing to its hard drives.Made a full-disk image is wrong because making a full-disk image can preserve all data on a hard disk, including deleted files and file fragments.Created a message digest for log files is wrong because creating a message digest for log files. A message digest is a cryptographic checksum that can demonstrate that the integrity of a file has not been compromised (e.g. changes to the content of a log file)Domain: LEGAL, REGULATIONS, COMPLIANCE AND INVESTIGATIONS
AIO 3rd Edition, page 783-784NIST 800-61 Computer Security Incident Handling guide page 3-18 to 3-20
As a result of a risk assessment, your security manager has determined that your organization needs to implement an intrusion detection system that can detect unknown attacks and can watch for unusual traffic behavior, such as a new service appearing on the network. What type of intrusion detection system would you select?
Traffic anomaly-based is the correct choice. An anomaly based IDS can detect unknown attacks. A traffic anomaly based IDS identifies any unacceptable deviation from expected behavior based on network traffic.Protocol anomaly based is not the best choice as while a protocol anomaly based IDS can identifyunknown attacks, this type of system is more suited to identifying deviations from established protocol standards such as HTTP. This type of IDS faces problems in analyzing complex or custom protocols.Pattern matching is not the best choice as a pattern matching IDS cannot identify unknown attacks. This type of system can only compare packets against signatures of known attacks.Stateful matching is not the best choice as a statful matching IDS cannot identify unknown attacks. This type of system works by scanning traffic streams for patterns or signatures of attacks.
Official guide to the CISSP CBK. pages 198 to 201
Which of the following is NOT a characteristic of a host-based intrusion detection system?
Answer(s): A
A HIDS does not consume large amounts of system resources is the correct choice. HIDS can consume inordinate amounts of CPU and system resources in order to function effectively, especially during an event.All the other answers are characteristics of HIDSesA HIDS can:scrutinize event logs, critical system files, and other auditable system resources; look for unauthorized change or suspicious patterns of behavior or activity can send alerts when unusual events are discovered
Official guide to the CISSP CBK. Pages 197 to 198.
Which of the following is NOT a fundamental component of an alarm in an intrusion detection system?
Response is the correct choice. A response would essentially be the action that is taken once an alarm has been produced by an IDS, but is not a fundamental component of the alarm.The following are incorrect answers:Communications is the component of an alarm that delivers alerts through a variety of channels such as email, pagers, instant messages and so on.An Enunciator is the component of an alarm that uses business logic to compose the content and format of an alert and determine the recipients of that alert. A sensor is a fundamental component of IDS alarms. A sensor detects an event and produces an appropriate notification.Domain: Access Control
Official guide to the CISSP CBK. page 203.
Which one of the following statements about the advantages and disadvantages of network-based Intrusion detection systems is true
Network-based IDSs are usually passive devices that listen on a network wire without interfering with the normal operation of a network. Thus, it is usually easy to retrofit a network to include network-based IDSs with minimal effort.Network-based IDSs are not vulnerable to attacks is not true, even thou network-based IDSs can be made very secure against attack and even made invisible to many attackers they still have to read the packets and sometimes a well crafted packet might exploit or kill your capture engine.Network-based IDSs are well suited for modern switch-based networks is not true as most switches do not provide universal monitoring ports and this limits the monitoring range of a network-based IDS sensor to a single host. Even when switches provide such monitoring ports, often the single port cannot mirror all traffic traversing the switch.Most network-based IDSs can automatically indicate whether or not an attack was successful is not true as most network-based IDSs cannot tell whether or not an attack was successful; they can only discern that an attack was initiated. This means that after a network-based IDS detects an attack, administrators must manually investigate each attacked host to determine whether it was indeed penetrated.
NIST special publication 800-31 Intrusion Detection System pages 15-16Official guide to the CISSP CBK. Pages 196 to 197
Post your Comments and Discuss ISC SSCP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SSCP content, but please register or login to continue.