Intrusion Detection Interview Questions

Intrusion Detection interview questions

Take as many assements as you can to improve your validate your skill rating

Total Questions: 10

1. What are the different ways to intrude ?

A. Buffer overflows

B. Unexpected combinations and unhandled input

C. Race conditions

D. All of the mentioned

Correct Answer is : All of the mentioned

2. What are major components of intrusion detection system ?

A. Analysis Engine

B. Event provider

C. Alert Database

D. All of the mentioned

Correct Answer is : All of the mentioned

3. What are the different ways to classify an IDS ?

A. anomaly detection

B. signature based misuse

C. stack based

D. all of the mentioned

Correct Answer is : all of the mentioned

4. What are the different ways to classify an IDS ?

A. Zone based

B. Host & Network based

C. Network & Zone based

D. Level based

Correct Answer is : Host & Network based

5. What are characteristics of anomaly based IDS ?

A. It models the normal usage of network as a noise characterization

B. It doesn’t detect novel attacks

C. Anything distinct from the noise is not assumed to be intrusion activity

D. It detects based on signature

Correct Answer is : It models the normal usage of network as a noise characterization

6. Which of the following is an advantage of anomaly detection?

A. Rules are easy to define

B. Custom protocols can be easily analyzed

C. The engine can scale as the rule set grows

D. Malicious activity that falls within normal usage patterns is detected

Correct Answer is : The engine can scale as the rule set grows

7. A false positive can be defined as…

A. An alert that indicates nefarious activity on a system that, upon further inspection, turns out to represent legitimate network traffic or behavior

B. An alert that indicates nefarious activity on a system that is not running on the network

C. The lack of an alert for nefarious activity

D. Both An alert that indicates nefarious activity on a system that, upon further inspection, turns out to represent legitimate network traffic or behavior and An alert that indicates nefarious activity on a system that is not running on the network

Correct Answer is : Both An alert that indicates nefarious activity on a system that, upon further inspection, turns out to represent legitimate network traffic or behavior and An alert that indicates nefarious activity on a system that is not running on the network

8. One of the most obvious places to put an IDS sensor is near the firewall. Where exactly in relation to the firewall is the most productive placement?

A. Inside the firewall

B. Outside the firewall

C. Both inside and outside the firewall

D. Neither inside the firewall nor outside the firewall.

Correct Answer is : Inside the firewall

9. What is the purpose of a shadow honeypot?

A. To flag attacks against known vulnerabilities

B. To help reduce false positives in a signature-based IDS

C. To randomly check suspicious traffic identified by an anomaly detection system

D. To enhance the accuracy of a traditional honeypot

Correct Answer is : To randomly check suspicious traffic identified by an anomaly detection system

10. At which two traffic layers do most commercial IDSes generate signatures?

A. Application layer

B. Network layer

C. Transport layer

D. both Transport layer and Network layer

Correct Answer is : both Transport layer and Network layer

Intrusion Detection interview questions