1.4 Identify and Describe Common Threat Detection Systems (e.g., Intrusion Detection System [IDS], Host-Based Intrusion Detection System [HIDS], Network-Based Detection System [NIDS]) CYBERSECURITY-APPRENTICE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is evaluating threat detection systems and wants to ensure they can detect both network-based attacks and insider threats that involve local file access. Which approach would provide the most complete coverage?

   • ADeploy a NIDS only
   • BDeploy a firewall with logging
   • CDeploy a NIDS to monitor network traffic and a HIDS on critical systems
   • DDeploy a HIDS on all systems only
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company has a mix of legacy systems that cannot have agents installed and modern servers that can. They need to monitor network traffic for attacks targeting the legacy systems. Which approach is most appropriate?

   • ADeploy a HIDS on the modern servers only
   • BDeploy a firewall with logging on the legacy systems
   • CDeploy a HIDS on the legacy systems
   • DDeploy a NIDS on the network segment where the legacy systems reside
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Where is a Network-Based Intrusion Detection System (NIDS) typically placed to monitor traffic?

   • AOn the firewall's management interface only
   • BInside the operating system of each endpoint
   • COn an individual server to monitor its logs
   • DAt a strategic point on the network, such as behind the firewall or at a network segment boundary
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A small business wants to add a detection system that can alert on suspicious network activity without blocking traffic. They have a limited budget and want to minimize changes to their existing network infrastructure. Which approach best meets these requirements?

   • AInstall a host-based IDS (HIDS) on every workstation and server
   • BReplace the existing firewall with an intrusion prevention system (IPS)
   • CEnable logging on all network devices and review logs manually
   • DDeploy a network-based IDS (NIDS) using a SPAN port on the core switch
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which statement best describes how an IDS operates on a network?

   • AIt analyzes traffic passively and sends alerts when anomalies are found
   • BIt replaces the firewall to filter all incoming connections
   • CIt prevents intrusions by automatically reconfiguring the firewall
   • DIt sits inline and drops packets that match attack signatures
   Reveal Solution Discussion Select an answer first