Which IDS category is primarily indicated by repeated probes of services, connections from unusual locations, repeated login attempts, and sudden influxes of log data?

Which IDS category is primarily indicated by repeated probes of services, connections from unusual locations, repeated login attempts, and sudden influxes of log data?

• A. Network Intrusions
• B. System Intrusions
• C. File System Intrusions
• D. A Sudden Influx of Log Data

Answer: (A)

This question is testing recognition of network-based intrusion indicators. Repeated probes of services are classic port-scanning and reconnaissance activity at the network level. Connections from unusual locations suggest traffic coming from geographies or IPs that don’t fit normal patterns, which is a sign of attacker infrastructure sweeping across the network. Repeated login attempts point to brute-force or credential-stuffing activities targeting services accessible over the network. A sudden influx of log data can occur when many network events trigger logging in a short period, often during an attack campaign or widespread scanning. Together, these symptoms reflect intrusion activity that is observed through network traffic and behavior, which is what a Network Intrusion category covers. In contrast, host- or file-based intrusions focus on compromising a specific machine or its files, not the broad network activity described. The sudden influx of log data is an important symptom but not a standalone intrusion category.

This question is testing recognition of network-based intrusion indicators. Repeated probes of services are classic port-scanning and reconnaissance activity at the network level. Connections from unusual locations suggest traffic coming from geographies or IPs that don’t fit normal patterns, which is a sign of attacker infrastructure sweeping across the network. Repeated login attempts point to brute-force or credential-stuffing activities targeting services accessible over the network. A sudden influx of log data can occur when many network events trigger logging in a short period, often during an attack campaign or widespread scanning.

Together, these symptoms reflect intrusion activity that is observed through network traffic and behavior, which is what a Network Intrusion category covers. In contrast, host- or file-based intrusions focus on compromising a specific machine or its files, not the broad network activity described. The sudden influx of log data is an important symptom but not a standalone intrusion category.