Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Arkusz Danych Pobierz pdf (Strona 14)

642 -531

Leading the way in IT testing and certification tools, www.testking.com

- 14 -

Early intrusion detection wa easily evaded by disguising an attack by unsing special

characters to conceal an attack. The term used to describe this evasive technique is

obfuscation. Obfuscation is now once again becoming a popular IDS evasive technique. The

following are forms of obfuscation:

1) Control characters

2) Hex representation

3) Unicode representation.

Cisco Courseware 3-27

QUESTION NO: 3

Why would an attacker saturate the network with “noise” while simultaneously

launching an attack?

A. causes the IDS to fire multiple false negative alarms

B. an attack may go undetected

C. it will have no effect on the sensor’s ability to detect attacks

D. to initiate asymmetric attack techniques

ANSWER: B

Explanation:

By flooding the network with noise traffic and causing the IDS to capture unnecessary

packets, the attacker can launch an attack that can go undetected. If the attack is detected, the

IDS resources may be exhausted causing a delayed response and thus is unable to respond in a

timely manner. In the figure, the attacker is sending large amounts of traffic as signified by

the larger pipe. Meanwhile, the actural attack is being sent to the target host, as represented by

the thin pipe that reaches the target host.

Cisco Courseware 3-24

QUESTION NO: 4

An attacker has launched an attack against a web server by requesting a web page using

the Unicode representation for the slash character in the URL.

What IDS evasive technique is the attacker using?

A. Encryption

B. Fragmentation

C. Flooding

D. Obfuscation

E. Saturation

Answer: D

Explanation: Intrusion detection systems typically implement obfuscation defense - ensuring

that suspect packets cannot easily be disguised with UTF and/or hex encoding and bypass the

Intrusion Detection systems.

1 2 ... 9 10 11 12 13 14 15 16 17 18 19 ... 167 168

Brak uwag

Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Arkusz Danych Strona 14