1. Which of the following appliance types is used to monitor networks for intrusion and malicious network activity?
a. Routers
b. Switches
c. Firewalls
d. VPN concentrators
e. IPS/IDS
2. The actions taken by a device in a promiscuous mode include sending alerts, alarms, log messages, or SNMP traps (true or false).
a. True
b. False
3. Which of the following intrusion prevention and detection devices are placed inline with the traffic?
a. Routers
b. Switches
c. Firewalls
d. IPS
e. IDS
4. Which of the following are valid IPS and IDS types (choose all that apply)?
a. Behavior-based
b. Network-based
c. Signature-based
d. Host-based
5. Behavior-based IPS appliances are software applications that protect servers or user machines by analyzing events occurring within that host (true or false).
a. True
b. False
6. Which of the following is not an activity performed by a vulnerability scanner?
a. Identifying network devices
b. Scanning for open ports
c. Performing tests from outside the network
d. Fixing discovered issues
7. Signature-based IPS works by monitoring traffic behavior and comparing it to traffic patterns defined as a baseline (true or false).
a. True
b. False
8. Which of the following defines a tool used to attract possible attackers in an isolated environment?
a. Honeypot
b. Vulnerability system
c. Nessus
d. IDS
e. IPS
9. Which of the following is an example of a vulnerability scanner?
a. Visio
b. PuTTY
c. Nessus
d. Wireshark
e. None of the above
10. Signature-based IPS is used only to protect user workstations (true or false).
a. True
b. False