Which of the following monitors network traffic in real time?

Which of the following is used to monitor network traffic or to monitor host audit logs in real time to determine
violations of system security policy that have taken place?

Which of the following is NOT a form of detective technical control?

What is the essential difference between a self-audit and an independent audit?

Which of the following is most appropriate to notify an external user that session monitoring is being
conducted?

An Intrusion Detection System (IDS) is what type of control?

What IDS approach relies on a database of known attacks?

Which of the following questions is LEAST likely to help in assessing controls covering audit trails?

Which of the following best describes signature-based detection?

Which of the following is NOT a characteristic of a host-based intrusion detection system?