CCD Intrusion Detection & Prevention 2 — Questions and Answers
Question 1: Which evasion technique involves an attacker sending packets with a TTL low enough to reach the IDS but not the target host?
- TTL manipulation (Correct answer)
- Fragmentation overlap
- Session splicing
- Polymorphic shellcode
Correct answer: TTL manipulation
TTL manipulation exploits differences between the IDS and the target host's TTL processing, causing the IDS to inspect packets the target never receives.
Question 2: A NIDS fails to alert on a known attack signature. What type of IDS error has occurred?
- False positive
- True negative
- False negative (Correct answer)
- True positive
Correct answer: False negative
A false negative occurs when an IDS fails to detect a real attack, allowing malicious traffic to pass without an alert.
Question 3: Which IPS deployment mode can actively block malicious traffic without requiring changes to network topology?
- Passive tap mode
- Inline mode (Correct answer)
- Span port mode
- Out-of-band mode
Correct answer: Inline mode
Inline mode places the IPS directly in the traffic path, allowing it to drop or modify packets in real time.
Question 4: What is the primary advantage of a host-based IDS (HIDS) over a network-based IDS (NIDS)?
- Lower deployment cost
- Ability to inspect encrypted traffic on the host (Correct answer)
- No impact on host performance
- Better at detecting distributed scans
Correct answer: Ability to inspect encrypted traffic on the host
HIDS operates on the endpoint and can inspect traffic after decryption, making it effective against encrypted threats that NIDS cannot see.
Question 5: An attacker sends an unusually large number of HTTP GET requests with slight URL variations to probe a web server. Which detection method best identifies this behavior?
- Signature-based detection
- Protocol anomaly detection
- Statistical anomaly detection (Correct answer)
- Checksumming
Correct answer: Statistical anomaly detection
Statistical anomaly detection establishes a baseline of normal request rates and flags deviations like excessive GET requests as suspicious.
Question 6: Which Snort rule option is used to search for a specific byte pattern in the packet payload?
- content (Correct answer)
- pcre
- flow
- flags
Correct answer: content
The 'content' keyword in Snort rules specifies a byte string or ASCII pattern to match within the packet payload.
Question 7: A security team notices their IPS is blocking legitimate business traffic to a partner site. What should they do first?
- Disable the IPS entirely
- Switch the IPS to detection-only mode
- Create a targeted exception rule for the legitimate traffic (Correct answer)
- Increase the alert threshold globally
Correct answer: Create a targeted exception rule for the legitimate traffic
Creating a targeted exception (whitelist) rule allows legitimate traffic while maintaining protection against actual threats.
CCD Intrusion Detection & Prevention 2
Which evasion technique involves an attacker sending packets with a TTL low enough to reach the IDS but not the target host?