Which type of tap makes the sniffed traffic available on many different
output ports connected to different types of monitoring devices?
Regeneration Tap
Which of the following will have a positive impact on your sensor processing
speed?
small number of signatures
Which type of tap takes the RX and TX signals and combines them back into
full-duplex traffic and sends it to a monitoring port?
port aggregator
What event will take place when valid traffic is dropped by an Intrusion
Prevention System (IPS) as a result of rules that may not be correct or may
not be tuned for your specific site?
false positive
Which of the following are a hybrid use of both a switch and tap?
span tap
Which type of tap will split the signal and offer bandwidth and distance
benefits?
Fiber
Which of the following command’s is used to associate a physical interface
(such as eth1 or eth2) with a logical interface?
???
Which of the following is NOT a concern when using a span port on a
switch?
???
Which device bleeds off the existing signal of traffic for capture?
tap
Which of the following is an inexpensive low-end solution for half-duplex
traffic, and is best used on networks where throughput is low?
Hub
Which of the following tools captures, indexes and correlates real-time
data in a searchable repository from which it can generate graphs, reports,
alerts, dashboards and visualizations?
Splunk – yeah right!
What is not an advantage of correlating IDS log data?
Reduced volume of data required for analysis
Which of the following correlation methods will compare the condition of a
host to an attack?
Statistical
Rule-based
Flow-based
Behavioral
statistical ??
When correlating data, there are four primary tasks. Which task is required
because different devices have different log formats that need to be
standardized?
Stored in a database
Normalization
Common encoding
Data acquisition
Normalization
Which of the following services must be used to help correlate log files
between multiple sources on a network?
SNMP
NTP
Syslog
NNTP
NTP
Which of the following will parse data from network, security, or system
devices and reorganize the data into a uniform format that can easily be
searched?
Intrusion Prevention System
Security Information Manager
Unified Threat Management Platform
Intrusion Detection System
Security Information Manager
