What are the characteristics of anomaly based IDS?

A. It models the normal usage of network as a nosie characterization
B. It doesn’t detect novel attacks
C. Anything distinct from the nosie is not assumed to be intrusion activity
D. It detects based on signature

What are the different ways to classify an IDS?

A. Zone based
B. Host & network based
C. Network & zone based
D. Level based

What are the major components of the intrusion detection system?

A. Analysis engine
B. Event provider
C. Alert database
D. All of the mentioned

What are the different ways to intrude?

A. Buffer overflows
B. Unexpected combinations and unhandled input
C. Race conditions
D. All of the mentioned

What is are two safe computing practices?

A. Not to open software from unknown vendors
B. Open and execute programs in admin level/root
C. Open and execute programs in presence of antivirus
D. None of the mentioned

What is known as a sandbox?

A. It is a program which can be molded to do the desired task
B. It is a program that is controlled or emulated section of os
C. It is a special mode of antivirus
D. None of the mentioned

How does an antivirus of today identify viruses?

A. Previously known patterns
B. It can detect unknown patterns
C. It can take high priority to increase scanning speed
D. None of the mentioned

How do viruses avoid basic pattern match of antivirus?

A. They are encrypted
B. They act with special permissions
C. They modify themselves
D. None of the mentioned

What are the two features of a tripwire file system?

A. It is a tool to monitor file systems
B. It is used to automatically take corrective action
C. It is used to secure unix system
D. None of the mentioned

Which direction access cannot happen using DMZ zone by default?

A. Company computer to dmz
B. Internet to dmz
C. Internet to company computer
D. Company computer to internet