Ch 11 Ethical Hacker Pro Review
Questions and Answers
An IT technician receives an IDS alert on the company network she manages. A
seemingly random user now has administration privileges in the system, some files are
missing, and other files seem to have just been created. Which of the following alerts
did this technician receive? ✅True positive
An IDS can perform many types of intrusion detections. Three common detection
methods are signature-based, anomaly-based, and protocol-based. Which of the
following best describes protocol-based detection? ✅This detection method can
include malformed messages and sequencing errors.
Which of the following IDS detection types compare behavior to baseline profiles or
network behavior baselines? ✅Anomaly-based
What are the two types of Intrusion Detection Systems (IDSs)? ✅HIDS and NIDS
You are on a Windows system. You receive an alert that a file named MyFile.txt.exe
had been found. Which of the following could this indicate? ✅Host-based IDS
Which of the following is a sign of a network-based intrusion? ✅New or unusual
protocols and services running.
ARP, DNS, and IP are all examples of which of the following? ✅Spoofing methods
An attacker conducts a normal port scan on a host and detects protocols used by a
Windows operating system and protocols used by a Linux operating system. Which of
the following might this indicate? ✅A honeypot
Which of the following is another name for the signature-based detection method?
✅Misuse detection
Ping of death, teardrop, SYN flood, Smurf, and fraggle are all examples of which of the
following? ✅DoS attack types
Robin, an IT technician, has implemented identification and detection techniques based
on the ability to distinguish legitimate traffic from illegitimate traffic over the network.
Which of the following is he trying to achieve? ✅Defend the network against IDS
evasions.
When it comes to obfuscation mechanisms, nmap has the ability to generate decoys,
meaning that detection of the actual scanning system becomes much more difficult.
Questions and Answers
An IT technician receives an IDS alert on the company network she manages. A
seemingly random user now has administration privileges in the system, some files are
missing, and other files seem to have just been created. Which of the following alerts
did this technician receive? ✅True positive
An IDS can perform many types of intrusion detections. Three common detection
methods are signature-based, anomaly-based, and protocol-based. Which of the
following best describes protocol-based detection? ✅This detection method can
include malformed messages and sequencing errors.
Which of the following IDS detection types compare behavior to baseline profiles or
network behavior baselines? ✅Anomaly-based
What are the two types of Intrusion Detection Systems (IDSs)? ✅HIDS and NIDS
You are on a Windows system. You receive an alert that a file named MyFile.txt.exe
had been found. Which of the following could this indicate? ✅Host-based IDS
Which of the following is a sign of a network-based intrusion? ✅New or unusual
protocols and services running.
ARP, DNS, and IP are all examples of which of the following? ✅Spoofing methods
An attacker conducts a normal port scan on a host and detects protocols used by a
Windows operating system and protocols used by a Linux operating system. Which of
the following might this indicate? ✅A honeypot
Which of the following is another name for the signature-based detection method?
✅Misuse detection
Ping of death, teardrop, SYN flood, Smurf, and fraggle are all examples of which of the
following? ✅DoS attack types
Robin, an IT technician, has implemented identification and detection techniques based
on the ability to distinguish legitimate traffic from illegitimate traffic over the network.
Which of the following is he trying to achieve? ✅Defend the network against IDS
evasions.
When it comes to obfuscation mechanisms, nmap has the ability to generate decoys,
meaning that detection of the actual scanning system becomes much more difficult.
