After a meeting between the IT department leaders and a security consultant, they decide to
implement
a new IDS in your network. You are later asked to explain to your team the type of IDS that is

going to be implemented. Which of the following best describes the process of Host-Based
Intrusion Detection Systems?

You have successfully implemented a new Intrusion Detection System in your network. You have
verified that the system is active and did detect the tests you have run against it thus far. You are
now in the stage of identifying the type of analysis you wish to use with the system. You meet with
the rest of the IT staff and are asked to describe the different options for analysis. Which of the
following best describes Interval Analysis?

You are configuring your new IDS machine, where you have recently installed Snort. While you
are working with this machine, you wish to create some basic rules to test the ability to log traffic
as you desire.
Which of the following Snort rules will log any telnet traffic from any IP address to port 23 of the
10.0.10.0/24 network?

You are configuring your new IDS machine, where you have recently installed Snort. While you
are working with this machine, you wish to create some basic rules to test the ability to log traffic
as you desire.
Which of the following Snort rules will log any tcp traffic from any IP address to any port between 1
and 1024 on any host in the 10.0.10.0/24 network?

You have discovered that your Bastion host has been compromised but cannot determine when
the compromise occurred. The best course of action for you to take would be:

You are configuring your new IDS machine, and are creating new rules. You enter the following
rule:
Alert tcp any any -> any 23 (msg: “Telnet Connection Attempt”;)
What is the effect of this rule?

You are configuring your new IDS machine, and are creating new rules. You enter the following
rule:
Alert tcp any any -> 10.0.10.0/24 any (msg: “SYN-FIN scan detected”; flags: SF;)
What is the effect of this rule?

If you wanted to configure your new system to use the process of detecting unauthorized activity
that matches known patterns of misuse, this system would be an example of which of the
following?

You are configuring your new IDS machine, and are creating new rules. You enter the following
rule:
Alert tcp any any -> 10.0.10.0/24 any (msg: “NULL scan detected”; flags: 0;)
What is the effect of this rule?

You are configuring your new IDS machine, and are creating new rules. You enter the following
rule:
Alert tcp any any -> 10.0.10.0/24 (msg: “O/S Fingerprint detected”; flags: S12;)
What is the effect of this rule?