Which of the following BEST describes Configuration Management controls?

Which of the following is a reasonable response from the Intrusion Detection System (IDS) when it detects
Internet Protocol (IP) packets where the IP source address and port is the same as the destination IP address
and port?

Why would anomaly detection IDSs often generate a large number of false positives?

Detective/Technical measures:

What would you call a network security control deployed in line to detects, alerts, and takes action when a
possible intrusion is detected.

Which of the following is an IDS that acquires data and defines a “normal” usage profile for the network or
host?

Which of the following is an issue with signature-based intrusion detection systems?

Attributes that characterize an attack are stored for reference using which of the following Intrusion Detection
System (IDS)?

What would be considered the biggest drawback of Host-based Intrusion Detection systems (HIDS)?

Which of the following reviews system and event logs to detect attacks on the host and determine if the attack
was successful?