Modules 11 – 12: Intrusion Prevention Group Exam
Network Security ( Version 1) – Network Security 1.0 Modules 11-12: Intrusion Prevention Group Exam Answers
1. What are two characteristics of both IPS and IDS sensors? (Choose two.)
- neither introduce latency or jitter
- both use signatures to detect patterns
- both are deployed inline in the data stream
- both can stop trigger packets
- both can detect atomic patterns
2. What is an advantage of using an IPS?
- It is installed outside of the data traffic flow.
- It does not impact network traffic if there is a sensor overload.
- It can stop trigger packets.
- It has no impact on network latency.
3. What is a characteristic of an IDS?
- It can affect network performance by introducing latency and jitter.
- It often requires assistance from other network devices to respond to an attack.
- It is installed inline with the network traffic flow.
- It can be configured to drop trigger packets that are associated with a connection.
4. What are two characteristics of an IPS operating in promiscuous mode? (Choose two.)
- It can stop malicious traffic from reaching the intended target for all types of attacks.
- It sits directly in the path of the traffic flow.
- It requires the assistance of another network device to respond to an attack.
- It does not impact the flow of packets in forwarded traffic.
- It sends alerts and drops any malicious packets.
5. Which tool can perform real-time traffic and port analysis, and can also detect port scans, fingerprinting and buffer overflow attacks?
6. Which Snort IPS feature enables a router to download rule sets directly from cisco.com or snort.org?
- Snort rule set pull
- Signature allowed listing
- Snort rule set push
- Snort rule set updates
7. What is a minimum system requirement to activate Snort IPS functionality on a Cisco router?
- at least 4 GB RAM
- at least 4 GB flash
- ISR 2900 or higher
- K9 license
8. What is PulledPork?
- an open source network IPS that performs real-time traffic analysis and generates alerts when threats are detected on IP networks
- a centralized management tool to push the rule sets based on preconfigured policy, to Cisco routers
- a virtual service container that runs on the Cisco ISR router operating system
- a rule management application that can be used to automatically download Snort rule updates
9. What are two actions that an IPS can perform whenever a signature detects the activity for which it is configured? (Choose two.)
- disable the link
- reconverge the network
- drop or prevent the activity
- allow the activity
- restart the infected device
10. Which IPS signature trigger category uses a decoy server to divert attacks away from production devices?
- honey pot-based detection
- policy-based detection
- pattern-based detection
- anomaly-based detection
11. What situation will generate a true negative IPS alarm type?
- normal traffic that generates a false alarm
- a verified security incident that is detected
- a known attack that is not detected
- normal traffic that is correctly being ignored and forwarded
12. Match each intrusion protection service with the description.
13. Match each Snort IPS rule action with the description.
14. What is provided by the fail open and close functionality of Snort IPS?
- provides the ability to automatically disable problematic signatures that routinely cause false positives and pass traffic
- blocks the traffic flow or bypasses IPS checking in the event of an IPS engine failure
- keeps Snort current with the latest threat protection and term-based subscriptions
- keeps track of the health of the Snort engine that is running in the service container
15. What is a characteristic of the Community Rule Set type of Snort term-based subscriptions?
- it has 60-day delayed access to updated signatures
- it uses Cisco Talos to provide coverage in advance of exploits
- it is fully supported by Cisco
- it is available for free
16. What is a characteristic of the connectivity policy setting when configuring Snort threat protection?
- it attempts to balance network security with network performance
- it prioritizes security over connectivity
- it provides the lowest level of protection
- it enables the highest number of signatures to be verified
17. What is contained in an OVA file?
- a current compilation of known threats and prevention mechanisms
- an installable version of a virtual machine
- a list of atomic and composite signatures
- a set of rules for an IDS or IPS to detect intrusion activity
18. What is a network tap?
- a Cisco technology that provides statistics on packets flowing through a router or multilayer switch
- a technology used to provide real-time reporting and long-term analysis of security events
- a feature supported on Cisco switches that enables the switch to copy frames and forward them to an analysis device
- a passive device that forwards all traffic and physical layer errors to an analysis device
19. Which statement describes the function of the SPAN tool used in a Cisco switch?
- It is a secure channel for a switch to send logging to a syslog server.
- It provides interconnection between VLANs over multiple switches.
- It supports the SNMP trap operation on a switch.
- It copies the traffic from one switch port and sends it to another switch port that is connected to a monitoring device.
20. A network administrator is trying to download a valid file from an internal server. However, the process triggers an alert on a NMS tool. What condition describes this alert?
- false negative
- false positive
- true negative
- true positive
21. What is an advantage of HIPS that is not provided by IDS?
- HIPS provides quick analysis of events through detailed logging.
- HIPS deploys sensors at network entry points and protects critical network segments.
- HIPS monitors network processes and protects critical files.
- HIPS protects critical system resources and monitors operating system processes.
22. What information must an IPS track in order to detect attacks matching a composite signature?
- the total number of packets in the attack
- the state of packets related to the attack
- the attacking period used by the attacker
- the network bandwidth consumed by all packets