What does this information pertain to?

It was uncovered that several attacks on a company’s network have been successful. The manager was told that this is because anomaly scores were set improperly and most likely too low. What does this information pertain to?

It was uncovered that several attacks on a company’s network have been successful. The manager was told that this is because anomaly scores were set improperly and most likely too low. What does this information pertain to?

A.
The behavioral IDS system was not properly tuned

B.
The IPS was not properly configured

C.
The host-based IDS was not properly configured

D.
The firewall was not properly configured

Explanation:
A statistical anomaly-based IDS is a behavioral-based system.
Behavioral-based IDS products do not use predefined signatures, but rather are put
in a learning mode to build a profile of an environment’s "normal"
activities. This profile is built by continually sampling the environment’s
activities. The longer the IDS is put in a learning mode, in most instances, the
more accurate a profile it will build and the better protection it will provide.
After this profile is built, all future traffic and activities are compared to it.
The same type of sampling that was used to build the profile takes place, so the
same type of data is being compared. Anything that does not match the profile is
seen as an attack, in response to which the IDS sends an alert. With the use of
complex statistical algorithms, the IDS looks for anomalies in the network traffic
or user activity. Each packet is given an anomaly score, which indicates its degree
of irregularity. If the score is higher than the established threshold of
"normal" behavior, then the preconfigured action will take place. If
anomaly scores are set too low, malicious activity can go unnoticed.



Leave a Reply 3

Your email address will not be published. Required fields are marked *


Greg

Greg

I like B. I will not disagree with anything stated in the Explanation. However, “The manager was told that [the attack was successful] because anomaly scores were set improperly.” Even if the statistical anomaly-based *IDS* was properly configured, it is a “DECTECTION” system, not “PREVENTION” system. There are two differences between A & B. One is tha A is more specific (behavioral system), and the other is that B is a PREVENTION system. The best answer would be a statistical anomaly-based IPS system, but that wasn’t listed.

Carlos alberto

Carlos alberto

Bien dicho B es la respuesta correcta.

Myrl Ludgood

Myrl Ludgood

Only wanna input on few general things, The website design and style is perfect, the subject matter is really fantastic : D.

http://www.bastcilkdoptb.com/