What is the primary goal of setting up a honeypot?
Answer(s): D
The primary purpose of a honeypot is to study the attack methods of an attacker for the purposes of understanding their methods and improving defenses."To lure hackers into attacking unused systems" is incorrect. Honeypots can serve as decoys but their primary purpose is to study the behaviors of attackers."To entrap and track down possible hackers" is incorrect. There are a host of legal issues around enticement vs entrapment but a good general rule is that entrapment is generally prohibited and evidence gathered in a scenario that could be considered as "entrapping" an attacker would not be admissible in a court of law."To set up a sacrificial lamb on the network" is incorrect. While a honeypot is a sort of sacrificial lamb and may attract attacks that might have been directed against production systems, its real purpose is to study the methods of attackers with the goals of better understanding and improving network defenses.
AIO3, p. 213
Who is responsible for providing reports to the senior management on the effectiveness of the security controls?
IT auditors determine whether systems are in compliance with the security policies, procedures, standards, baselines, designs, architectures, management direction and other requirements" and "provide top company management with an independent view of the controls that have been designed and their effectiveness.""Information systems security professionals" is incorrect. Security professionals develop the security policies and supporting baselines, etc."Data owners" is incorrect. Data owners have overall responsibility for information assets and assign the appropriate classification for the asset as well as ensure that the asset is protected with the proper controls."Data custodians" is incorrect. Data custodians care for an information asset on behalf of the data owner.
CBK, pp. 38 - 42.AIO3. pp. 99 - 104
Which of the following are the two MOST common implementations of Intrusion Detection Systems?
The two most common implementations of Intrusion Detection are Network-based and Host-based.IDS can be implemented as a network device, such as a router, switch, firewall, or dedicated device monitoring traffic, typically referred to as network IDS (NIDS).The" (IDS) "technology can also be incorporated into a host system (HIDS) to monitor a single system for undesirable activities. "A network intrusion detection system (NIDS) is a network device .... that monitors traffic traversing the network segment for which it is integrated." Remember that NIDS are usually passive in nature.HIDS is the implementation of IDS capabilities at the host level. Its most significant difference from NIDS is that related processes are limited to the boundaries of a single-host system. However, this presents advantages in effectively detecting objectionable activities because the IDS process is running directly on the host system, not just observing it from the network.
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 3649-3652). Auerbach Publications. Kindle Edition.
Network-based Intrusion Detection systems:
Answer(s): A
Network-based ID systems:- Commonly reside on a discrete network segment and monitor the traffic on that network segment- Usually consist of a network appliance with a Network Interface Card (NIC) that is operating in promiscuous mode and is intercepting and analyzing the network packets in real time"A passive NIDS takes advantage of promiscuous mode access to the network, allowing it to gain visibility into every packet traversing the network segment. This allows the system to inspect packets and monitor sessions without impacting the network, performance, or the systems and applications utilizing the network."NOTE FROM CLEMENT:A discrete network is a synonym for a SINGLE network. Usually the sensor will monitor a single network segment, however there are IDS today that allow you to monitor multiple LAN's at the same time.References used for this question:KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 62.andOfficial (ISC)2 Guide to the CISSP CBK, Hal Tipton and Kevin Henry, Page 196 andAdditional information on IDS systems can be found here:http://en.wikipedia.org/wiki/Intrusion_detection_system
Which of the following are additional terms used to describe knowledge-based IDS and behavior- based IDS?
The two current conceptual approaches to Intrusion Detection methodology are knowledge-based ID systems and behavior-based ID systems, sometimes referred to as signature-based ID and statistical anomaly-based ID, respectively.
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 63.
Post your Comments and Discuss ISC SSCP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SSCP content, but please register or login to continue.