ITC Chapter 4 Quiz Online

An IDS, or intrusion detection system, is a device that can scan packets and compare them to a set of rules or attack signatures. If the packets match attack signatures, then the IDS can create an alert and log the detection.

A compromised or hacked computer that is controlled by a malicious individual or group is known as a bot. A group of these hacked computers under the control of a malicious individual or group is known as a botnet.

Behavior-based security uses informational context to detect anomalies in the network.

Snort is an open source intrusion protection system (IPS) that is capable of performing real-time traffic and port analysis, packet logging, content searching and matching, as well as detecting probes, attacks, port scans, fingerprinting, and buffer overflow attacks.

The Cyber Kill Chain describes the phases of a progressive cyberattack operation. The phases include the following:

*Reconnaissance
*Weaponization
*Delivery
*Exploitation
*Installation
*Command and control
*Actions on objectives

In general, these phases are carried out in sequence. However, during an attack, several phases can be carried out simultaneously, especially if multiple attackers or groups are involved.

A firewall is a network device used to filter inbound or outbound traffic or both.

DDoS, or distributed denial of service, attacks are used to disrupt service by overwhelming network devices with bogus traffic.

NetFlow is used both to gather details about the traffic that is flowing through the network, and to report it to a central collector.