1.4 Identify and Describe Common Threat Detection Systems (e.g., Intrusion Detection System [IDS], Host-Based Intrusion Detection System [HIDS], Network-Based Detection System [NIDS]) CYBERSECURITY-APPRENTICE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team is considering deploying an IDS. They want the system to generate alerts on suspicious activity but not interfere with normal operations. Which deployment characteristic is most important to meet this requirement?

   • AThe IDS is configured to automatically block IP addresses
   • BThe IDS is placed inline and can drop malicious packets
   • CThe IDS operates passively, monitoring traffic without blocking it
   • DThe IDS is placed on a management network only
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has a NIDS that generates a high volume of alerts, many of which are false positives. The security team is overwhelmed and is considering deploying a HIDS to help reduce the noise. Which approach is most effective?

   • AReplace the NIDS with the HIDS
   • BIncrease the sensitivity of the NIDS to catch more threats
   • CDisable the NIDS alerts and rely only on the HIDS
   • DUse the HIDS to validate NIDS alerts by checking for corresponding host-level activity
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is considering deploying an IDS that can also take action to block malicious traffic. They are concerned about the risk of blocking legitimate traffic. Which type of system should they deploy to minimize this risk?

   • AAn IDS that can be configured to block traffic on demand
   • BAn IDS that operates in passive mode and only generates alerts
   • CAn IPS that blocks traffic only after manual review
   • DAn IPS that automatically blocks all suspicious traffic
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is reviewing alerts from a NIDS and a HIDS. The NIDS flagged a series of connections to a known malicious IP, and the HIDS flagged a suspicious process on a server. Which conclusion is most appropriate?

   • AThe alerts together suggest a possible compromise that warrants further investigation
   • BThe NIDS alert is a false positive because the HIDS did not flag the same IP
   • CThe HIDS alert is more important than the NIDS alert and should be investigated first
   • DThe alerts are unrelated and should be investigated separately
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is deploying detection systems and has a requirement to monitor both network traffic and host activity. They have a limited budget and need to choose between a NIDS and a HIDS. Which factor is most important in making this decision?

   • AThe number of employees in the company
   • BThe type of threats the company is most concerned about
   • CThe color of the server racks
   • DThe brand of the network equipment
   Reveal Solution Discussion Select an answer first