A security team is deploying a NIDS in a network with a core switch that uses SPAN ports. They want to monitor traffic between two critical servers. What is the most important consideration for this deployment?

Disable the firewall on the NIDS to avoid blocking traffic

Ensure the SPAN port is configured to capture traffic from the correct source ports

Place the NIDS on the same subnet as the servers

Ensure the NIDS has a public IP address

Which of the following is a common method to test an IDS's detection capability?

Replaying captured malicious traffic through the network

Using a vulnerability scanner to identify open ports

Checking the IDS log for system uptime

What is the primary difference between signature-based and anomaly-based intrusion detection?

Signature-based detection is slower but more accurate, while anomaly-based is faster but less accurate

Signature-based detection uses machine learning, while anomaly-based detection relies on predefined rules

Signature-based detection is only used in host-based systems, while anomaly-based is only used in network-based systems

Signature-based detection compares traffic to known attack patterns, while anomaly-based detection identifies deviations from a baseline of normal behavior

Where is a network-based IDS (NIDS) typically placed to monitor traffic entering and leaving a network?

At the network perimeter, such as behind the firewall

On the router's configuration file

Certified Tester Security Tester

Domain 5Objective 5

Intrusion Detection CT-SEC Practice Questions (Page 4)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

8concepts

Questions 16–20

16foundation · easy
Which of the following is a popular open-source network-based intrusion detection system known for its rule-based detection engine?
Select an answer first
17application · medium
A security team is deploying a NIDS in a network with a core switch that uses SPAN ports. They want to monitor traffic between two critical servers. What is the most important consideration for this deployment?
Select an answer first
18foundation · easy
Which of the following is a common method to test an IDS's detection capability?
Select an answer first
19foundation · easy
What is the primary difference between signature-based and anomaly-based intrusion detection?
Select an answer first
20foundation · easy
Where is a network-based IDS (NIDS) typically placed to monitor traffic entering and leaving a network?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.