nerdexam
EC-Council

312-50V11 · Question #724

Which of the following statements is FALSE with respect to Intrusion Detection Systems?

The correct answer is A. Intrusion Detection Systems can easily distinguish a malicious payload in an encrypted traffic. IDS systems cannot inspect the contents of encrypted traffic, making the claim that they can 'easily distinguish' malicious payloads in encrypted streams a false statement.

Evading IDS, Firewalls, and Honeypots

Question

Which of the following statements is FALSE with respect to Intrusion Detection Systems?

Options

  • AIntrusion Detection Systems can easily distinguish a malicious payload in an encrypted traffic
  • BIntrusion Detection Systems can examine the contents of the data in context of the network
  • CIntrusion Detection Systems can be configured to distinguish specific content in network packets
  • DIntrusion Detection Systems require constant update of the signature library

How the community answered

(40 responses)
  • A
    90% (36)
  • B
    5% (2)
  • C
    3% (1)
  • D
    3% (1)

Why each option

IDS systems cannot inspect the contents of encrypted traffic, making the claim that they can 'easily distinguish' malicious payloads in encrypted streams a false statement.

AIntrusion Detection Systems can easily distinguish a malicious payload in an encrypted trafficCorrect

Network-based IDS relies on deep packet inspection and signature matching against payload content. When traffic is encrypted (TLS/SSL), the payload is ciphertext and is opaque to the IDS engine. Without performing SSL/TLS interception or decryption, the IDS cannot read or match signatures against the data, making this statement false and the correct answer.

BIntrusion Detection Systems can examine the contents of the data in context of the network

This is true - IDS can examine packet contents within the context of entire network sessions and flows, which is a core capability.

CIntrusion Detection Systems can be configured to distinguish specific content in network packets

This is true - IDS can absolutely be configured with specific content signatures or rules (such as Snort rules) to match particular strings or byte patterns in unencrypted packets.

DIntrusion Detection Systems require constant update of the signature library

This is true - signature-based IDS requires continuous signature library updates to detect newly discovered attack patterns and malware.

Concept tested: IDS limitations with encrypted network traffic

Source: https://www.cisco.com/c/en/us/td/docs/security/ips/7-0/configuration/guide/idm/idmguide7/idm_overview.html

Topics

#IDS limitations#encrypted traffic#intrusion detection#signature library

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V11 Practice