328.2 Network Intrusion Detection (weight: 4) LPIC-3-SECURITY Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of bandwidth usage monitoring in network intrusion detection?

   • ATo replace the need for signature-based detection systems
   • BTo encrypt all network traffic to prevent eavesdropping
   • CTo identify unusual traffic patterns that may indicate malicious activity
   • DTo enforce quality of service policies on the network
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A Snort IDS is generating a high volume of alerts for a rule that detects outbound connections to a known malware domain. The analyst verifies that the alerts are triggered by a legitimate business application that uses the same domain for updates. What is the best approach to reduce false positives while maintaining detection capability?

   • ADelete the rule entirely because it is causing too many false positives.
   • BCreate a pass rule for the specific source IP of the business application, placed before the alert rule.
   • CAdd a 'threshold' option to the rule to limit the number of alerts per time period.
   • DChange the rule's action from 'alert' to 'log' to reduce the impact on the SIEM.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security administrator installs Snort on a system with a single NIC and wants to monitor traffic on the local network segment. The NIC is configured with an IP address, and the administrator wants Snort to analyze all traffic on the segment. What is the most important configuration step to ensure Snort captures all traffic?

   • ASet the HOME_NET variable to the NIC's IP address to ensure Snort only analyzes traffic to that host.
   • BUse the 'daq' option to configure Snort to use the afpacket module for faster packet capture.
   • CConfigure Snort to use the 'inline' mode to actively block malicious traffic.
   • DPlace the NIC in promiscuous mode so it captures all packets on the segment.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   After running an OpenVAS scan against a web server, a security analyst reviews the results. The report lists a vulnerability with a CVSS score of 9.8, but the analyst knows the affected service is not exposed to the internet and is only accessible from a restricted management VLAN. What should the analyst do to prioritize remediation accurately?

   • ARe-run the scan with credentials to confirm the vulnerability is real before taking any action.
   • BIgnore the finding because the service is not internet-facing and therefore poses no risk.
   • CImmediately patch the service because the CVSS score is critical and cannot be ignored.
   • DAdjust the severity rating in the report to reflect the reduced exposure and schedule remediation accordingly.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In a NASL script, which function is commonly used to send an HTTP request to a target web server?

   • Asend_request()
   • Bopen_sock()
   • Chttp_get()
   • Ddisplay()
   Reveal Solution Discussion Select an answer first