You are configuring your new Intrusion Detection System, and studying the true-false matrix. You read about the different types of alarms and events. Which of the following defines an event where an alarm is indicating an intrusion when there is an actual intrusion?

You are configuring the new machine in your network that you wish to be used for Snort in your network.
What is the switch used when telling Snort to apply the rules in the Snort Configuration file to packets processed by snort?

You are going to configure your SuSe Linux computer to run Snort as your IDS. Prior to running Snort, you wish to configure Apache and PHP, so you may use Snort monitoring tools in the browser. You need to verify that Apache and PHP are running properly. What line needs to be entered in the info.php file to test PHP on your Apache server?

You have configured Snort, running on your Windows Server 2003, to connect to a MySQL database.
You are now creating the Snort database in MySQL. At the MySQL prompt, what is the correct command to create a database named: snortdb1?

Your new Intrusion Detection System involves a customized Snort machine with a complex rule set. One thing you wish to accomplish is to identify payload datA. When using Snort and you need to see the data in the payload in a packet, what switch should you use?

You have just installed a new network-based IDS for your organization. You are in the middle of your initial configuration of the system, and are now configuring the response. What is the most common response of an IDS when an event happens?

What is the primary difference between proxy and packet filtering when the firewall is making a decision
as to whether it should or should not allow a packet through?

You are reviewing the IDS logs and during your analysis you notice a user account that had attempted to log on to your network ten times one night between 3 and 4 AM. This is quite different from the normal pattern of this user account, as this user is only in the office from 8AM to 6PM. Had your IDS detected this anomaly, which of the following types of detection best describes this event?

You are configuring a new custom IPSec policy on your Windows Server 2003 machine. On the rules tab, you find the three default options under the IP Filter List. What are these three default options?

You are configuring your new IDS machine, and are creating new rules. You enter the following rule:
Alert tcp any any -> 10.0.10.0/24 (msg: “O/S Fingerprint detected”; flags: S12;) What is the effect of this rule?