CCD Intrusion Detection & Prevention 3

Question 1

Which technique do attackers use to bypass signature-based IDS by encoding shellcode so each instance looks different?

Accepted Answer

Polymorphic encoding

Answer

Polymorphic encoding mutates shellcode's binary pattern on each use, evading static signature matching while preserving functionality.

Question 2

What does the term 'alert fatigue' mean in the context of IDS operations?

Accepted Answer

Analysts becoming desensitized due to excessive false positives

Answer

Alert fatigue occurs when analysts are overwhelmed by large volumes of alerts—many false positives—causing real threats to be missed.

Question 3

In Zeek (formerly Bro), what is a 'notice' used for?

Accepted Answer

Recording a network event worthy of analyst attention

Answer

Zeek notices are log entries generated when the analysis framework detects an event that warrants human or automated review.

Question 4

Which IDS evasion method exploits inconsistencies in how different OS TCP/IP stacks reassemble fragmented packets?

Accepted Answer

IP fragmentation overlap

Answer

IP fragmentation overlap sends overlapping fragment offsets that different OS stacks reassemble differently, causing the IDS to see different data than the target.

Question 5

A SIEM correlates IDS alerts with firewall logs and authentication logs to identify a threat. What is this process called?

Accepted Answer

Event correlation

Answer

Event correlation in a SIEM aggregates and analyzes related events from multiple sources to identify patterns indicating a threat.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Intrusion Detection & Prevention 3