GCIA IDS Signature Analysis Quiz

1. How can attackers evade IDS using obfuscation?

By using multiple IP addresses

By encoding payloads to bypass signature recognition

By flooding the network with traffic

By targeting only encrypted channels

2. Which element of a network packet can an IDS use to detect command injection attacks?

TTL field

Payload content containing suspicious shell commands

Source MAC address

IP header checksum

3. In IDS signature tuning, what is the goal of adjusting threshold values?

To increase network speed

To balance detection accuracy and false positive rates

To encrypt all traffic

To block all inbound connections

4. What does TCP stream reassembly accomplish in IDS analysis?

Encrypts sensitive data

Reconstructs fragmented packets into complete messages for inspection

Reduces network latency

Authenticates the source address

5. Which metric measures the effectiveness of an IDS signature?

Bandwidth utilization

Detection rate and false positive rate

Packet processing speed

Physical memory usage

6. What is the primary limitation of signature-based detection?

It consumes too much bandwidth

It cannot detect unknown or zero-day attacks

It requires manual log review

It only works on wireless networks

7. How do polymorphic malware evade signature-based IDS?

By using only encrypted protocols

By changing its code while maintaining the same function

By attacking only during off-peak hours

By spoofing legitimate source addresses

8. What is a signature rule in the context of IDS?

A mathematical formula for encryption

A set of conditions defining a specific attack pattern

A log entry documenting detected threats

A certificate used for authentication

9. Which type of attack does a SQL injection signature typically detect?

Network reconnaissance

Unauthorized database access through malicious queries

DDoS flooding

Password brute-force attempts

10. What is the role of a preprocessor in an IDS?

To encrypt network traffic

To normalize and reassemble packets for signature matching

To block detected attacks automatically

To log all network activity

11. What is the primary purpose of an IDS signature?

To encrypt network traffic

To identify known attack patterns in network traffic

To block all incoming connections

To authenticate user credentials

12. What is payload inspection in IDS analysis?

Checking only packet headers

Examining the content of data packets for malicious code

Verifying packet checksums

Monitoring connection duration

13. Which protocol is most commonly analyzed by IDS for web-based attacks?

DNS

HTTP/HTTPS

SMTP

FTP

14. In signature-based detection, what must be true for a signature to match an attack?

All signature criteria must be met

Only half the criteria must match

The attack must be encrypted

The source IP must be blacklisted

15. What does a zero-day attack exploit?

A known vulnerability with a published patch

An unknown vulnerability with no existing signature

A misconfigured firewall

Weak password policies

16. Which field in a network packet is commonly used in IDS signatures?

MAC address only

Source and destination IP, port, and protocol

TTL value only

Physical layer information

17. What is the main difference between NIDS and HIDS?

NIDS monitors networks; HIDS monitors individual hosts

NIDS is more accurate than HIDS

HIDS can detect encrypted threats

NIDS requires no network access

18. Which evasion technique uses fragmentation to bypass IDS detection?

Polymorphism

IP fragmentation

Encryption

Obfuscation

19. What does a false positive in IDS detection mean?

An actual attack that goes undetected

Legitimate traffic flagged as malicious

A malicious packet that bypasses the IDS

A signature that is outdated

20. Which of the following is a characteristic of anomaly-based detection?

Relies on predefined attack patterns

Detects deviations from normal network behavior

Requires constant signature updates

Only identifies known threats