Reference no: EM132418710
Part 1: True or False Questions.
1. To have a Snort rule match on both inbound and outbound traffic, the rule should use the flow:to_server,from_client,established; option.
2. Host-based IDS can be used to monitor compliance with corporate policies such as acceptable use of computer resources.
3. An on-demand operational IDS model is not suitable if legally admissible data collection is required.
4. Current criminal and civil procedure laws and rules of evidence do not apply to digital and electronic forms of evidence such as IDS logs.
5. Snort unified output handling tools are used to off-load computing tasks from the core Snort program to improve overall performance.
6. Thresholds used in Snort alert rules can cause false negatives if the attacker works slowly enough.
7. Network-based IDS provides no protection against internal threats.
8. When a "pass" rule is matched in Snort, no other rules are evaluated for the packet.
9. To ensure proper execution of Snort rules using the "uricontent" option the HTTP Inspect preprocessor must be installed and configured in Snort.
10. There are no monitoring situations that justify real-time intrusion response.
Attachment:- Test Question.rar