IDS Fundamentals and Network Architecture GCIA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A security analyst needs to detect unauthorized changes to critical system files on a server. Which type of IDS is best suited for this task?

   • AHost-based IDS (HIDS)
   • BSignature-based NIDS
   • CNetwork-based IDS (NIDS)
   • DHybrid IDS
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A NIDS generates an alert for a potential SQL injection attack against a web application. The analyst sees that the source IP is from a foreign country and the destination is a public web server. The web server logs show that the request returned a 500 error. What is the most appropriate next step?

   • AIgnore the alert because the source is from a foreign country
   • BCheck the web server logs and packet capture to determine if the SQL injection was successful
   • CBlock the source IP at the firewall
   • DEscalate the alert to incident response immediately
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of an intrusion detection system (IDS) in network security?

   • ATo monitor and analyze network or host activity for signs of malicious behavior
   • BTo encrypt all traffic traversing the network
   • CTo actively block malicious traffic in real time
   • DTo replace firewalls as the primary network defense
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A NIDS generates an alert for a known exploit against a web server. The analyst checks the alert and sees that the source IP is a well-known vulnerability scanner and the destination is a public web server. The analyst also sees that the web server returned a 404 error for the requested URI. What is the most appropriate next step?

   • ATreat the alert as a true positive and escalate to incident response
   • BImmediately block the source IP at the firewall
   • CDisable the NIDS signature to prevent future false positives
   • DCorrelate the alert with the web server logs and packet capture to confirm whether the exploit was successful
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A NIDS has generated an alert for a signature that matches a known exploit against a web server. The analyst checks the web server logs and finds no corresponding request. The alert was triggered by traffic to a different server on the same network segment. The analyst must decide how to respond. Which action is most appropriate?

   • ABlock the source IP at the firewall immediately
   • BInvestigate the target server and the source IP to determine if the exploit was attempted or successful
   • CDisable the signature because it is generating alerts for the wrong server
   • DClose the alert as a false positive because the web server logs show no request
   Reveal Solution Discussion Select an answer first