GCIA Network Intrusion Detection Quiz

1. Which of the following is a common evasion technique against IDS systems?

IP fragmentation and TCP stream reassembly attacks

Using standard HTTP protocols

Logging all user activities

Implementing strong encryption

2. In incident response, what is the primary value of IDS logs?

To provide forensic evidence of attack patterns and timing

To automatically remediate compromised systems

To predict future attacks with certainty

To replace the need for backup systems

3. What is the primary purpose of packet reassembly in network intrusion detection?

To reconstruct fragmented or out-of-order packets for accurate analysis

To compress network traffic

To encrypt sensitive payloads

To reduce IDS processing load

4. Which of the following is a key metric for evaluating IDS effectiveness?

Detection rate and false positive rate

Network bandwidth consumption only

Physical sensor location only

Number of sensors deployed

5. What is the primary difference between IDS and IPS systems?

IDS detects threats; IPS detects and blocks threats

IPS uses signatures; IDS uses anomalies only

IDS is more expensive than IPS

IPS operates only at Layer 2

6. In the context of IDS alerts, what does 'alert fatigue' refer to?

Overwhelming number of alerts reducing analyst effectiveness

Physical exhaustion of IDS hardware

Temporary loss of network connectivity

Inability to update signature databases

7. Which protocol is commonly monitored for suspicious DNS queries indicating command-and-control communication?

DNS (UDP port 53)

SMTP (port 25)

POP3 (port 110)

IMAP (port 143)

8. What is the primary role of a Security Information and Event Management (SIEM) system in relation to IDS?

To aggregate, correlate, and analyze IDS alerts for better threat detection

To replace the need for IDS entirely

To encrypt all IDS traffic

To block all detected attacks automatically

9. Which data source is most valuable for detecting lateral movement within a network?

NetFlow and internal network traffic analysis

Web server access logs only

Firewall perimeter logs only

Email gateway logs

10. In intrusion detection, what does 'tuning' an IDS primarily involve?

Adjusting rules and thresholds to reduce false positives while maintaining detection

Increasing the processing power of the IDS

Adding more IDS sensors to the network

Replacing signature databases daily

11. What is the primary difference between a network-based IDS and a host-based IDS?

Network-based IDS monitors traffic; host-based IDS monitors system activity on individual computers

Network-based IDS requires more processing power than host-based IDS

Host-based IDS can detect encrypted threats; network-based IDS cannot

Network-based IDS is only used in firewalls; host-based IDS is standalone software

12. What is the purpose of baselining in anomaly-based intrusion detection?

To establish normal network behavior for comparison

To create attack signatures

To encrypt sensitive data

To configure firewall rules

13. Which OSI layer does network-based intrusion detection primarily operate at?

Layers 3 and 4

Layer 1 only

Layer 7 only

Layer 2 only

14. What is the primary advantage of inline IDS deployment over passive monitoring?

It can block malicious traffic in real-time

It requires less processing power

It eliminates the need for firewalls

It provides better visibility into encrypted traffic

15. In Snort IDS, what does the 'content' keyword specify in a rule?

The payload data pattern to match

The source IP address

The destination port number

The protocol version

16. Which of the following attacks is most difficult to detect using signature-based IDS?

Zero-day exploits

SQL injection attacks

Buffer overflow attacks

Brute force password attacks

17. What is the primary purpose of network segmentation in intrusion detection?

To reduce the scope of monitoring and limit attack spread

To increase bandwidth for IDS sensors

To eliminate the need for firewalls

To encrypt all network traffic automatically

18. Which protocol is commonly used to configure and manage remote IDS sensors?

SNMP

SSH

HTTP

FTP

19. In the context of IDS, what does a 'false positive' indicate?

A legitimate activity flagged as malicious

A malicious activity that goes undetected

An attack that successfully compromises the system

A failed attempt to bypass the IDS

20. Which of the following is a signature-based detection method used by IDS systems?

Pattern matching against known attack signatures

Statistical analysis of normal network behavior

Machine learning classification of anomalies

Behavioral analysis of user activity patterns