MENU
ETHER: Destination address : 0000BA5EBA11 ETHER: Source address :
An employee wants to defeat detection by a network-based IDS application. He does not want to attack the system containing the IDS application. Which of the following strategies can be used to defeat detection by a network-based IDS application?
Suggested Answer: B
Get Premium CPEH-001 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Certain types of encryption presents challenges to network-based intrusion detection and may leave the IDS blind to certain attacks, where a host-based IDS analyzes the data after it has been decrypted.
13 comments · newest first
WH
Whitney
12 months ago
Wait, can a network tunnel really defeat IDS? Sounds too easy.
AL
Alise
12 months ago
Ping flood? Seems too obvious to me.
SH
Shawnna
1 year ago
SYN flood? That's a bit risky, isn't it?
AL
Alton
1 year ago
I think creating multiple false positives is a solid strategy!
EV
Evelynn
1 year ago
A network tunnel can help bypass detection.
LE
Leota
1 year ago
I practiced a question similar to this, and I feel like creating a network tunnel might be the most effective strategy for stealth.
SH
Shantay
1 year ago
SYN floods seem like a classic attack method, but I wonder if they would really help in defeating detection without targeting the IDS itself.
CA
Cammy
1 year ago
I think creating multiple false positives could confuse the IDS, but I can't recall if that's a common tactic.
JU
Julene
1 year ago
I remember studying how network tunnels can help in evading detection, but I'm not entirely sure if that's the best option here.
AN
Antonio
1 year ago
Hmm, this one seems a bit tricky. I'll need to think through the definitions carefully to determine which statement is true.
SK
Skye
1 year ago
I remember something about BGP authentication needing to match on both ends, but I'm not entirely sure how the MD5 settings impact that.
EL
Elroy
1 year ago
The VXLAN equivalent to a VLAN ID has to be one of the options provided. Based on my understanding, the VNI, or VXLAN Network Identifier, is used to identify the virtual network, so I'm going to go with B.
XO
Xochitl
1 year ago
Wait, I'm confused. Is a domain just a group of related attributes, or is it specifically about the valid values? I'm going to have to review my notes on relational database concepts before answering this one.