You are configuring your new Intrusion Detection System, and studying the true-false matrix. You
read about the different types of alarms and events. Which of the following defines an event where
an alarm is indicating an intrusion when there is no actual intrusion?

As you increase the layers of security in your organization you must watch the network behavior
closely.
What kind of problems can an improperly configured IDS cause in your network?

You are considering adding layers to your authentication system currently in place. Reading
through some of the vendor literature on logon solutions, it frequently mentions two and three
factor authentication. Your assistant asks you what the difference between the two is. Select the
options that correctly describe two-factor and three-factor authentication:

You have just found a user who has performed an improper utilization of resources inside the
organization both intentionally and unintentionally. This user has just provided you with a working
example of which of the following?

The main reason you have been hired at a company is to bring the network security of the
organization up to current standards. A high priority is to have a full security audit of the network
as soon as possible. You have chosen an Independent Audit and are describing it to your
coworkers. Which of the following best describes an Independent audit?

You have been hired at a large company to manage network security issues. Prior to your arrival,
there was no one dedicated to security, so you are starting at the beginning. You hold a meeting
and are discussing the main functions and features of network security. One of your assistants
asks what the function of Authentication in network security is. Which of the following best
describes Authentication?

You have been hired at a large company to manage network. Prior to your arrival, there was no
one dedicated to security, so you are starting at the beginning. You hold a meeting and are
discussing the main functions and features of network security. One of your assistants asks what
the function of Integrity in network security is. Which of the following best describes Integrity?

During your packet capture of traffic to check if your network is getting hit by a Denial of Service
attack, you analyze TCP headers. You notice there are many headers that seem to have the same
SEQ number, with the responding computer using different SEQ and ACK numbers in response. If
you are analyzing a normal three-way handshake between two Windows 2000 nodes, and the first
packet has a SEQ of
0xD36077AF, what will the responding computer use as an ACK?

The exhibit shows the partial contents of a Network Monitor capture on a Windows 2000 FTP Server.
Each line represents information pertaining to a frame. What is the sequence number used by
TCP for the second part of the three way handshake?

During a security review of the network it is decided to run a full packet capture over a 24 hour
period and log the packets for analysis. You have been chosen to analyze all the TCP packets. To
prepare you study the RFC for TCP and have identified all the parts of the TCP header. Which of
the following are parts of the TCP header?