Use the questions here to review what you learned in this chapter. The correct answers are found in the Appendix, “Answers to Chapter Review Questions.”
Which two modes of IPS operations are currently available with Cisco IDS and IPS solutions? Select all that apply.
Which device cannot be an IDS or IPS sensor?
- A Cisco router configured with IPS software
- A Cisco VPN concentrator configured with IPS software
- An appliance specifically designed to provide dedicated IDS or IPS services
- A IDS/IPS network module installed in a Cisco ASA or in a switch or in a router
Which general patterns of misuse do IDS and IPS technologies look for? (Choose all that apply.)
- Atomic pattern
- Molecular pattern
- Intrusive nonces
- Composite pattern
- Composition pattern
Which of the following is not a type of IDS or IPS sensor?
- Signature based
- Policy based
- Transgression based
- Anomaly based
- Honeypot based
What are signature engines?
- A set of rules that an IDS and an IPS use to detect typical intrusive activity
- A full-feature intrusion prevention located in the core network fabric device
- An internal security service module that provides dedicated CPU and memory to offload intrusion prevention processing.
- A component of an IDS and IPS sensor that supports a group of signatures that are in a common category
Reorder the steps taken by a host-based IPS.
- HIPS checks the call against the policy.
- An application calls for system resources.
- Requests are allowed or denied.
Which of the following are advantages of a network-based IPS?
- Provides application-level encryption protection
- Is host specific
- Analyzes lower-level network events
- Not visible on the network
Which IPS card could integrate into a Cisco 1841?
- Cisco IDSM-2
- Cisco ASA AIP SSM
- Cisco IPS AIM
- Cisco IPS 4200 series sensor
What is an IPS signature?
- A message digest encrypted with the sender’s private key
- A set of rules used to detect typical intrusive activity
- A binary pattern specific to a virus
- An appliance that provides anti-x services
Compiling a regular expression found in a signature requires more memory than the final storage of the regular expression. True or False?