AP Cybersecurity topic 3.5
Detecting Network Attacks
Intrusion detection systems (IDS) watch traffic and alert on known attack signatures or unusual behavior. Intrusion prevention systems (IPS) can also block it. Analysts read logs and packet captures, look for patterns like many failed connections, and use a SIEM to collect events from many sources in one place.
Detecting Network Attacks vocabulary
- IDS: Intrusion detection system: alerts on suspicious traffic.
- IPS: Intrusion prevention system: detects and blocks suspicious traffic.
- Signature-based detection: Matching traffic against patterns of known attacks.
- SIEM: A system that gathers and correlates security logs from many devices.
AP-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
IDS alert summary, 01:00-01:05 Source 192.0.2.44 -> 10.1.1.0/24 TCP SYN to ports 21, 22, 23, 25, 53, 80, 110, 139, 443, 445, 3389 254 hosts probed in 47 seconds
1. Which of the following activities is indicated by this alert?
- (A) A port scan
- (B) A phishing campaign
- (C) A ransomware infection
- (D) A password reset
Show answer
(A) A port scan Probing many ports across many hosts in seconds is network reconnaissance (a port scan).
2. A school switches from an intrusion detection system (IDS) to an intrusion prevention system (IPS). Which of the following is a new risk of this change?
- (A) Attacks will no longer be logged
- (B) A false positive could block legitimate traffic, disrupting users
- (C) The network will lose all encryption
- (D) Signature updates will stop
Show answer
(B) A false positive could block legitimate traffic, disrupting users An IPS takes action automatically, so a mistaken alert can block real users.
3. A company wants one dashboard that collects and correlates logs from firewalls, servers, and laptops. Which tool meets this need?
- (A) SIEM
- (B) VPN
- (C) Antivirus
- (D) Access control vestibule
Show answer
(A) SIEM A security information and event management (SIEM) system centralizes and correlates logs.
4. Which of the following is a likely impact of relying only on signature-based network detection?
- (A) New attacks with no known signature may go undetected
- (B) Every normal activity will trigger alerts
- (C) Detection will require no updates
- (D) Encryption will stop working
Show answer
(A) New attacks with no known signature may go undetected Signatures only match known attacks, so new ones can be false negatives.