Intrusion Detection and Packet Analysis GCED Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security team is evaluating an IDS for a network that frequently sees new, custom applications generating unusual traffic patterns. The team is concerned about zero-day exploits and wants to minimize false positives. Which detection method is most appropriate?

   • AA combination of signature-based and stateful protocol analysis, as it covers both known attacks and protocol violations.
   • BSignature-based detection, as it is reliable for known attacks.
   • CAnomaly-based detection, as it can identify unusual behavior that may indicate zero-day exploits.
   • DStateful protocol analysis, as it understands protocol states and can detect violations.
   Reveal Solution Discussion Select an answer first
2. 37expert · medium

   An IDS generates a high number of alerts for a specific signature. The analyst investigates and finds that the alerts are triggered by a legitimate application that uses a protocol that is similar to the attack pattern. The analyst needs to reduce the false positives while maintaining detection for actual attacks. Which approach is most effective?

   • AIncrease the threshold for the signature to reduce the number of alerts.
   • BCreate a whitelist rule to suppress alerts for the specific application's IP addresses and ports.
   • CSwitch the IDS to anomaly-based detection to avoid signature-specific false positives.
   • DDisable the signature that is causing the false positives.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   When an IDS generates an alert that indicates a possible security incident, what is the FIRST step in integrating this finding into incident response?

   • AImmediately disconnect the affected system from the network
   • BVerify the alert and assess its severity
   • CDelete the alert to reduce noise
   • DReboot the affected system to clear any malware
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which command-line tool is commonly used to capture packets on a Linux interface and display them in real time?

   • Anmap
   • Btcpdump
   • Cnetstat
   • DWireshark
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security team is choosing an IDS for a network that carries both encrypted and unencrypted traffic. The team needs to detect known malware signatures and also identify protocol anomalies. They are concerned about evasion via encryption. Which detection method is most resilient to encryption-based evasion?

   • AStateful protocol analysis on the application layer
   • BSignature-based detection on the network payload
   • CAnomaly-based detection on traffic metadata (e.g., flow records, packet sizes, timing)
   • DSignature-based detection on the TLS handshake
   Reveal Solution Discussion Select an answer first