CCD Intrusion Detection & Prevention 3 — Questions and Answers
Question 1: Which technique do attackers use to bypass signature-based IDS by encoding shellcode so each instance looks different?
- Session splicing
- Polymorphic encoding (Correct answer)
- Slow-rate scanning
- Teardrop fragmentation
Correct answer: Polymorphic encoding
Polymorphic encoding mutates shellcode's binary pattern on each use, evading static signature matching while preserving functionality.
Question 2: What does the term 'alert fatigue' mean in the context of IDS operations?
- IDS hardware overheating from high traffic
- Analysts becoming desensitized due to excessive false positives (Correct answer)
- Signature database becoming too large to process
- Network bandwidth consumed by IDS logs
Correct answer: Analysts becoming desensitized due to excessive false positives
Alert fatigue occurs when analysts are overwhelmed by large volumes of alerts—many false positives—causing real threats to be missed.
Question 3: In Zeek (formerly Bro), what is a 'notice' used for?
- Blocking malicious connections in real time
- Recording a network event worthy of analyst attention (Correct answer)
- Updating the signature database automatically
- Encrypting captured traffic for storage
Correct answer: Recording a network event worthy of analyst attention
Zeek notices are log entries generated when the analysis framework detects an event that warrants human or automated review.
Question 4: Which IDS evasion method exploits inconsistencies in how different OS TCP/IP stacks reassemble fragmented packets?
- Unicode encoding
- IP fragmentation overlap (Correct answer)
- DNS tunneling
- Slow-and-low attack
Correct answer: IP fragmentation overlap
IP fragmentation overlap sends overlapping fragment offsets that different OS stacks reassemble differently, causing the IDS to see different data than the target.
Question 5: A SIEM correlates IDS alerts with firewall logs and authentication logs to identify a threat. What is this process called?
- Log normalization
- Alert deduplication
- Event correlation (Correct answer)
- Signature tuning
Correct answer: Event correlation
Event correlation in a SIEM aggregates and analyzes related events from multiple sources to identify patterns indicating a threat.
Question 6: What is the purpose of the 'threshold' keyword in a Snort rule?
- Set the minimum packet size to inspect
- Limit alert generation to reduce noise for repetitive events (Correct answer)
- Define the maximum scan depth in the payload
- Specify the traffic direction to monitor
Correct answer: Limit alert generation to reduce noise for repetitive events
The 'threshold' keyword controls how frequently Snort generates alerts for the same rule, preventing alert floods from repetitive events.
Question 7: Which type of IDS analyzes the sequence of system calls made by processes to detect malicious activity?
- Network-based IDS
- Host-based IDS using syscall analysis (Correct answer)
- Wireless IDS
- Protocol-based IDS
Correct answer: Host-based IDS using syscall analysis
Host-based IDS can monitor sequences of system calls to detect anomalous process behavior indicative of exploitation or malware.
CCD Intrusion Detection & Prevention 3
Which technique do attackers use to bypass signature-based IDS by encoding shellcode so each instance looks different?