Which of the following is a reasonable response from the intrusion detection system when it
detects Internet Protocol (IP) packets where the IP source address is the same as the IP
destination address?

Which of the following is not a good response to a detected intrusion?

Once an intrusion into your organizations information system has been detected, which of the
following actions should be performed first?

After an intrusion has been contained and the compromised systems having been reinstalled,
which of the following need not be reviewed before bringing the systems back to service?

Which of the following includes notifying the appropriate parties to take action in order to
determine the extent of the severity of an incident and to remediate the incident’s effects?

Which of the following is used to monitor network traffic or to monitor host audit logs in order to
determine violations of security policy that have taken place?

Which of the following is not a technique used for monitoring?

Which one of the following is NOT a characteristic of an Intrusion Detection System? (IDS)

An IDS detects an attack using which of the following?

Which of the following monitors network traffic in real time?