You are part of a security staff at a highly profitable bank and each day, all traffic on the network is logged for
later review. Every Friday when major deposits are made you’re seeing a series of bits placed in the “Urgent
Pointer” field of a TCP packet. This is only 16 bits which isn’t much but it concerns you because:

Several analysis methods can be employed by an IDS, each with its own strengths and weaknesses, and their
applicability to any given situation should be carefully considered. There are two basic IDS analysis methods
that exist.
Which of the basic method is more prone to false positive?

A packet containing a long string of NOP’s followed by a command is usually indicative of what?

Organizations should consider which of the following first before allowing external access to their LANs via the
Internet?

Which of the following describes the sequence of steps required for a Kerberos session to be established
between a user (Principal P1), and an application server (Principal P2)?

Which of the following is NOT a countermeasure to traffic analysis?

Which of the following answers presents the MOST significant threat to network based IDS or IPS systems?

Which of the following is LESS likely to be used today in creating a Virtual Private Network?

Which of the following should be used as a replacement for Telnet for secure remote login over an insecure
network?

Which of the following was designed as a more fault-tolerant topology than Ethernet, and very resilient when
properly implemented?