CCD Intrusion Detection & Prevention 2

Question 1

Which evasion technique involves an attacker sending packets with a TTL low enough to reach the IDS but not the target host?

Accepted Answer

TTL manipulation

Answer

TTL manipulation exploits differences between the IDS and the target host's TTL processing, causing the IDS to inspect packets the target never receives.

Question 2

A NIDS fails to alert on a known attack signature. What type of IDS error has occurred?

Accepted Answer

False negative

Answer

A false negative occurs when an IDS fails to detect a real attack, allowing malicious traffic to pass without an alert.

Question 3

Which IPS deployment mode can actively block malicious traffic without requiring changes to network topology?

Accepted Answer

Inline mode

Answer

Inline mode places the IPS directly in the traffic path, allowing it to drop or modify packets in real time.

Question 4

What is the primary advantage of a host-based IDS (HIDS) over a network-based IDS (NIDS)?

Accepted Answer

Ability to inspect encrypted traffic on the host

Answer

HIDS operates on the endpoint and can inspect traffic after decryption, making it effective against encrypted threats that NIDS cannot see.

Question 5

An attacker sends an unusually large number of HTTP GET requests with slight URL variations to probe a web server. Which detection method best identifies this behavior?

Accepted Answer

Statistical anomaly detection

Answer

Statistical anomaly detection establishes a baseline of normal request rates and flags deviations like excessive GET requests as suspicious.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Intrusion Detection & Prevention 2