Exam Questions

Exam Questions

Part 1: True or False Questions. (10 questions at 1 point each)



T FTo have a Snort rule match on both inbound and outbound traffic, the rule should use the flow:to_server,from_client,established; option. Answer: False

T FHost-based IDS can be used to monitor compliance with corporate policies such as acceptable use of computer resources. Answer: True

T FAn on-demand operational IDS model is not suitable if legally admissible data collection is required. Answer: True

T FCurrent criminal and civil procedure laws and rules of evidence do not provide clear guidance on digital and electronic forms of evidence such as IDS logs. Answer: ...