GCIA Intrusion Detection Systems (IDS) and Security Information and Event Management (SIEM)

Question 1

Which type of IDS is designed to monitor network traffic and detect malicious activity by analyzing packet data?

Accepted Answer

Network-based IDS

Answer

Host-based IDS

Answer

Signature-based IDS

Answer

Anomaly-based IDS

Question 2

What is the primary function of a SIEM system in network security?

Accepted Answer

To collect, aggregate, and analyze security event data

Answer

To block unauthorized access

Answer

To provide detailed network traffic analysis

Answer

To conduct vulnerability assessments

Question 3

Which of the following is a common method used by IDS systems to reduce false positives?

Accepted Answer

Applying correlation rules

Answer

Using a broad signature set

Answer

Implementing anomaly detection

Answer

Disabling alerts

Question 4

Which log source would provide information about user login attempts and authentication events?

Accepted Answer

Authentication logs

Answer

Web server logs

Answer

Firewall logs

Answer

DNS logs

Question 5

Which type of analysis involves comparing current network traffic patterns to established baselines to detect anomalies?

Accepted Answer

Statistical analysis

Answer

Signature-based analysis

Answer

Heuristic analysis

Answer

Behavior-based analysis