Signature and Alarm Management Review Questions and Answers

1. 

What is a subsignature ID?

1. The signature ID

2. The signature ID combined with the host ID

3. The signature ID combined with the organization ID

4. The ID of the subsignature associated with the CIDS signature

2. 

What is the NSDB?

1. The network security database that contains all CIDS signatures

2. The network security database that contains all 1000, 2000, 3000, 4000, and 5000 series signatures

3. The network security database that contains descriptions of all CIDS signatures and vulnerabilities

4. The network security database located on the sensor and used to define the configured signatures

3. 

Which of the following accurately lists all the possible alarm levels?

1. 1, 2, 3, 4, 5

2. Low, Medium, High

3. 1, 3, 5

4. Low, Medium, High, Critical

4. 

Which of the following accurately lists all the possible severity levels?

1. 1, 2, 3, 4, 5

2. Low, Medium, High

3. 1, 3, 5

4. Low, Medium, High, Critical

5. 

Which of the following categories describes the amount of packets a signature must analyze to make a match? (Choose two.)

1. Composite

2. Context

3. Atomic

4. Content

6. 

Which of the following is an example of a signature class?

1. Denial of service class

2. General signature class

3. String signature class

4. Access control lists

7. 

Which of the following signatures have an associated subsignature? (Choose two.)

1. General signatures

2. String signatures

3. Access control lists

4. Reconnaissance class

8. 

Which of the following is an example of a signature implementation?

1. Composite

2. Atomic

3. Context

4. Access class

9. 

Which of the following signature series is responsible for analyzing the IP protocol?

1. 2000 series

2. 1000 series

3. 4000 series

4. 9000 series

10. 

Which of the following is not a valid CIDS signature series?

1. 2000 series

2. 5000 series

3. 7000 series

4. 10000 series