Active detection IDS systems may perfor m which of the following when a unauthorized connection attempt is discovered? (Choose all that apply)
A.
Inform the attacker that he is connecting to a protected network.
B.
Shut down the server or service.
C.
Provide the attacker the usernames and passwords for administrative accounts.
D.
Break of suspicious connections.
Explanation:
Active response involves taking an action based upon an attack or threat. The goal of an active response would be to take the quickest action possible to reduce the potential impact of an event. Terminating connections, processes, or sessions are responses that may occur in the event of a unauthorized connection.
A and C are wrong for obvious reasons.
Reference: Security + (SYBEX) page 181