Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Datenblatt PDF herunterladen (Seite 9)

642 -531

Leading the way in IT testing and certification tools, www.testking.com

- 9 -

An individual sensor contains two separate interfaces. The sensor used on of the interfaces to

passively sniff all the network packets by placing the interface in Promiscuous mode. The

sensor uses the other network interface for command and control traffic.

Reference: Cisco Secure Intrusion Detection System (Ciscopress) page 98

QUESTION NO: 7

What reconnaissance methods are used to discover servers running SMTP and SNMP?

(Choose two)

A. TCP scans for port 25

B. UDP scans for port 25

C. UDP scans for port 161

D. ICMP sweeps for port 25

E. ICMP sweeps for port 161

Answer: A, C

Explanation:

If the public SMTP server were compromised, a hacker might try to attack the internal mail

server over TCP port 25, which is permitted to allow mail transfer between the two hosts.

SNMP is a network management protocol that can be used to retrieve information from a

network device (commonly referred to as read-only access) or to remotely configure

parameters on the device (commonly referred to as read-write access). SNMP agents listen on

UDP port 161.

Reference: SAFE Blueprint for Small, Midsize, and Remote-User Networks

Section 2: Explain the difference between true and false, and

positive and negative alarms (4 questions)

QUESTION NO: 1

Which of the following statements represents a false positive alarm situation?

A normal traffic or a benign action will not cause a signature to fire

B offending traffic will not cause a signature to fire

C normal traffic or a benign action will result in the signature firing

D offending traffic causes a signature to fire

Answer: C

Explanation:

A false positive is a situation in which normal traffic or a bnign action causes the signature to

fire. Consider the following scenario: a signature exists that generates alarms if any network

devices’ enable password is entered incorrectly. A network administrator attemts to log in to a

1 2 3 4 5 6 7 8 9 10 11 12 13 14 ... 167 168

Keine Kommentare

Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Datenblatt Seite 9