Intrusion Detection CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a key configuration consideration when deploying an IDS to ensure it can see all relevant traffic?

   • ASetting the IDS to promiscuous mode on a wireless access point
   • BInstalling the IDS on the same subnet as the web server
   • CPlacing it on a hub instead of a switch
   • DConfiguring the network switch to use port mirroring (SPAN) or a network tap
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is reviewing IDS alerts and finds that a single alert has been generated thousands of times in the past hour for the same source and destination IPs. The analyst determines it is a false positive caused by a misconfigured application. What is the most appropriate action?

   • AIncrease the severity of the alert to ensure it is not missed
   • BModify the IDS rule to suppress this specific false positive pattern
   • CDelete the alerts from the log to reduce storage usage
   • DDisable the IDS until the application is fixed
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In security testing, what role does an intrusion detection system (IDS) play?

   • AIt prevents unauthorized access by enforcing access control policies
   • BIt automatically patches vulnerabilities in the target system
   • CIt simulates attacks to test the target's defenses
   • DIt provides a mechanism to verify that security controls are effective by detecting attack attempts
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which type of intrusion detection system monitors network traffic by analyzing packet headers and payloads?

   • APerimeter-based IDS
   • BHost-based IDS (HIDS)
   • CApplication-based IDS
   • DNetwork-based IDS (NIDS)
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of an intrusion detection system (IDS) in the context of security testing?

   • ATo actively block malicious traffic in real time
   • BTo monitor and analyze network or host activity for signs of security incidents
   • CTo replace the need for firewalls and antivirus software
   • DTo encrypt all data transmitted across the network
   Reveal Solution Discussion Select an answer first