Detective/Technical measures:

What would you call a network security control deployed in line to detects, alerts, and takes action when a
possible intrusion is detected.

Which of the following is an IDS that acquires data and defines a “normal” usage profile for the network or
host?

Which of the following is an issue with signature-based intrusion detection systems?

Attributes that characterize an attack are stored for reference using which of the following Intrusion Detection
System (IDS)?

What would be considered the biggest drawback of Host-based Intrusion Detection systems (HIDS)?

Which of the following reviews system and event logs to detect attacks on the host and determine if the attack
was successful?

The fact that a network-based IDS reviews packets payload and headers enables which of the following?

Which of the following usually provides reliable, real-time information without consuming network or host
resources?

A host-based IDS is resident on which of the following?