CASP+:Chapter 4(1of2)

Which analysis technique does a NIDS use to compare observed traffic to known attacks defined by a signature?

• A) Anomaly-based analysis.

• B) Behavior-based analysis.

• C) Signature-based analysis.

• D) Protocol-based analysis.

What is the primary function of a Network Intrusion Detection System (NIDS)?

• A) To actively prevent unauthorized access to network resources.

• B) To monitor network traffic and detect signs of suspicious activity.

• C) To encrypt network communications to protect data in transit.

• D) To optimize network performance and ensure high availability.

Which protocol collects network traffic data by aggregating packets into flows and then exporting them for analysis based on information such as source and destination addresses, ports, and protocols used?

• A) NetFlow.

• B) SNMP.

• C) sFlow.

• D) DNSSEC.

Which tool is commonly used to monitor changes to operating system files and other data by generating a hash of monitored files and comparing it to an established baseline value?

• A) Simple Network Management Protocol (SNMP).

• B) Intrusion Detection System (IDS).

• C) File Integrity Monitoring (FIM).

• D) Network Access Control (NAC).

What method is commonly used for capturing network traffic for packet and protocol analysis by Network Intrusion Detection Systems (NIDS)?

• A) Test access port (TAP).

• B) Spanning Tree Protocol (STP).

• C) Intrusion Prevention System (IPS).

• D) Virtual LAN (VLAN) tagging.

How does DNSSEC enhance the security of traditional DNS?

• A) By encrypting DNS queries and responses to ensure confidentiality.

• B) By preventing unauthorized access to DNS servers through access control mechanisms.

• C) By providing a validation process for DNS responses to mitigate against spoofing and poisoning attacks.

• D) By optimizing the performance of DNS servers to reduce query response times.

What distinguishes a transparent proxy from a non-transparent proxy?

• A) A transparent proxy requires client configuration with the proxy server address and port number.

• B) A transparent proxy is configured with filters for multiple protocol types.

• C) A transparent proxy intercepts client traffic without the client needing to be reconfigured.

• D) A transparent proxy accepts client connections on port 8080.

What is a characteristic of a host-based Web Application Firewall (WAF)?

• A) It offers the greatest flexibility and performance.

• B) It requires minimal computational resources.

• C) It complicates the configuration of the web application.

• D) It is delivered via a cloud platform.

What are the two primary applications of VPN in an enterprise setting?

• A) Providing secure access to network resources and optimizing network performance.

• B) Enabling remote access for employees and contractors, and connecting branch locations.

• C) Encrypting network traffic and authenticating users for secure communication.

• D) Managing network traffic and implementing access control policies.

Which deployment method of a Web Application Firewall (WAF) offers the greatest flexibility and performance but is also the most costly to acquire and maintain?

• A) Network-based

• B) Host-based

• C) Cloud-based

• D) Proxy-based