V.S.B.

ENGINEERING COLLEGE, KARUR

(An Autonomous Institution)
Department of Computer Science and Business Systems
B. E. / [Link]. End Semester Theory Examinations, April/May 2025
CCS340 Cyber Security
Part - A (10 x 2 = 20 Marks)
1. How do Cyber Criminals use the Dark Web?
Cyber criminals use the dark web to conduct illegal activities anonymously.
This includes buying/selling stolen data, drugs, weapons, fake IDs, and hacking
services through hidden marketplaces.
2. List the elements of Cyber Crime.

 Offender (cybercriminal)
 Victim
 Target system/network
 Tools used (malware, phishing, etc.)
 Intent (theft, disruption, etc.)

3. Mention the scope of cyber-attacks.

Cyber-attacks can target individuals, organizations, and governments,
impacting data confidentiality, integrity, and availability through methods like
phishing, malware, ransomware, and DDoS attacks.
4. How can phishing be classified as a type of social engineering attack?
Phishing manipulates users into revealing confidential information (like
passwords or credit card details) by pretending to be a trusted source, exploiting
human psychology rather than system flaws.
5. What is the process of extracting information from email servers during a
reconnaissance attack?
It involves techniques like banner grabbing, open relay testing, and SMTP
enumeration to gather email server information without alerting the target.
6. List the purpose of OS fingerprinting technique.
To identify the operating system running on a target machine, helping
attackers or security analysts plan suitable exploits or defenses.
7. Outline the Intrusion Detection Exchange Format.
It is a standardized XML format used to exchange intrusion detection
information between systems for better security coordination and response.
8. What are the advantages of using a hybrid intrusion detection system over a
single type of IDS?

 Combines strengths of signature-based and anomaly-based IDS

 Improves detection accuracy
 Reduces false positives
 Offers better protection against known and unknown threats

9. What is an access policy in firewalls?

It defines the rules about which traffic is allowed or blocked based on IP
addresses, ports, and protocols.
10. Mention the firewall characteristics.

 Packet filtering
 Stateful inspection
 Proxy services
 Network Address Translation (NAT)
 Policy enforcement

PART - B (5 × 13 = 65 Marks)

11. a) Discuss the provisions of the Indian IT Act 2000. How does the IT Act
address cybercrimes such as hacking, identity theft and cyber terrorism?

The Indian IT Act 2000 (amended in 2008) is the primary law for addressing
cybercrimes and electronic commerce in India. It provides legal recognition to
electronic records and digital signatures and ensures that crimes committed in
cyberspace are punishable.

Key Provisions of the IT Act:

 Section 43: Deals with unauthorized access, data theft, virus introduction,
and denial of service.
 Section 66: Penalizes hacking—intentional destruction or alteration of
information with imprisonment up to 3 years or fine up to ₹5 lakh.
 Section 66C: Deals with identity theft—unauthorized use of another’s
password, digital signature, or biometric.
 Section 66D: Covers cheating by personation using a computer resource.
 Section 66E: Penalizes violation of privacy by capturing or transmitting
images without consent.
 Section 66F: Addresses cyber terrorism—unauthorized access to protected
systems with intent to threaten national integrity or cause death/injury.

Cybercrime-Specific Coverage:

 Hacking: Section 66 identifies and penalizes unlawful access and data

tampering.
  Identity Theft: Section 66C handles online impersonation and use of digital
credentials.
 Cyber Terrorism: Section 66F is crucial for national security, especially
against terrorists using networks to cause chaos.
 Obscenity: Section 67 penalizes publishing obscene materials in electronic
form.
 Child Pornography: Section 67B punishes acts involving children in
obscene content.

Enforcement & Jurisdiction:

 Cybercrime cells are established in major cities.

 The law applies to offenses committed outside India if the target system is
located in India.

Significance:

 Provides a legal framework for e-governance and e-commerce.

 Supports digital evidence recognition in courts.
 Establishes Cert-In for incident response.

The IT Act plays a vital role in safeguarding digital India, ensuring that both
civil and criminal liabilities exist for various online offenses. Regular amendments are
essential to keep up with evolving cyber threats.

(OR)

11.b) Explain the different types of Cyber Criminals with necessary illustrations.
Cyber criminals are individuals or groups who use technology to commit
illegal activities over the internet. They differ based on motivation, expertise, and type
of attack.

Types of Cyber Criminals:

1. Hackers:

 White Hat Hackers: Ethical hackers who help find system vulnerabilities
legally.
 Black Hat Hackers: Break into systems for malicious purposes like data
theft.
 Example: A black hat hacker exploiting zero-day vulnerabilities to breach a
bank.

2. Script Kiddies:

 Inexperienced individuals using ready-made scripts to launch attacks.

 Example: A student using downloaded tools to deface a school website.
3. Hacktivists:

 Cyber activists promoting social, political, or religious agendas.

 Example: Anonymous hacking government websites to protest internet

censorship.

4. Insiders:

 Employees or former staff members misusing access privileges.

 Example: An IT admin leaking confidential client data to competitors.

5. Cyber Terrorists:

 Target critical infrastructure to cause panic or damage.

 Example: Gaining access to a country’s power grid to disrupt electricity.

6. Phishers:

 Create fake websites/emails to steal sensitive information.

 Example: A fake bank email tricking users into entering their login
credentials.

7. Cyberstalkers:

 Use the internet to harass or threaten individuals.

 Example: Constantly sending threats via social media.

8. Financial Cybercriminals:

 Focused on stealing financial information like credit card details.

 Example: Installing malware on POS terminals in retail chains.

12. a) Discuss the different types of malicious attacks and their impact with
suitable example.
Malicious attacks are deliberate actions intended to damage, steal, or disrupt
computer systems. They vary in intent, complexity, and impact.

Types and Impact:

1. Virus:

 Attaches to host files and spreads via user interaction.

 Impact: Data loss, system slowdowns.
 Example: Melissa virus affecting MS Word documents.

2. Worm:

 Self-replicating code that spreads without user help.

 Impact: Network congestion, DoS attacks.
  Example: Code Red worm affecting web servers.

3. Trojan Horse:

 Appears as legitimate software but opens a backdoor.

 Impact: Unauthorized remote access.
 Example: Zeus Trojan stealing banking credentials.

4. Ransomware:

 Encrypts files and demands payment for decryption.

 Impact: Financial loss, operational disruption.
 Example: WannaCry ransomware affected global hospitals.

5. Spyware:

 Secretly monitors user activity.

 Impact: Loss of privacy and credentials.
 Example: Keyloggers recording passwords.

6. Adware:

 Displays unwanted ads, often bundled with software.

 Impact: Annoyance, data tracking.

7. Rootkits:

 Hide presence of malware by modifying OS functions.

 Impact: Hard to detect and remove.

8. Logic Bombs:

 Triggered by specific events or dates.

 Impact: Unpredictable behavior like data deletion.

(OR)

12. b) Elaborate the countermeasures and its types, applications, merits and
demerits.
Cybersecurity countermeasures are tools, policies, or actions implemented to
prevent, detect, and respond to cyber threats.

Types of Countermeasures:

1. Preventive:

 Aim: Stop attacks before they happen.

 Examples: Firewalls, antivirus software, access control.
 Merits: Proactive, reduces risk.
 Demerits: Might block legitimate actions; costly.
2. Detective:

 Aim: Identify attacks in progress or post-attack.

 Examples: Intrusion Detection Systems (IDS), log monitoring.
 Merits: Real-time alerts; threat visibility.
 Demerits: Requires constant monitoring.

3. Corrective:

 Aim: Restore systems to normal after an attack.

 Examples: Data backups, re-imaging, patching.
 Merits: Enables recovery; limits damage.
 Demerits: Doesn't prevent future attacks.

4. Deterrent:

 Aim: Dissuade potential attackers.

 Examples: Legal penalties, warning banners.
 Merits: Low cost; psychological defense.
 Demerits: Not foolproof.

5. Applications:

 Banking: Fraud detection systems.

 Healthcare: HIPAA-compliant systems.
 E-commerce: End-to-end encryption and secure payment gateways.

An effective cybersecurity strategy requires a layered defense with a

combination of all countermeasure types based on risk assessment.

13. a) Distinguish between extracting information from DNS with email servers.

Feature DNS (Domain Name System) Email Server

Manages sending and receiving
Purpose Converts domain names to IP addresses
of emails
SMTP (port 25), IMAP (143),
Protocol UDP/TCP – Port 53
POP3 (110)
Tools dig, nslookup, host telnet, smtp-user-enum, netcat
Domain names, subdomains, MX User enumeration, open relay
Extraction Info
records, SOA status, banner
Common Email spoofing, SMTP
DNS Spoofing, Zone transfer
Attacks enumeration
To find usernames and SMTP
Recon Use To find hosts/IPs on a target domain
configuration
dig [Link] MX reveals mail SMTP VRFY command verifies
Data Example
servers valid users

(OR)
13. b) Analyze the different types of scanning and explain in detail.
Scanning is a crucial phase in cyber attacks and penetration testing, used to
discover vulnerabilities in target systems.

Types of Scanning:

1. Port Scanning:

 Checks open/closed ports on a host.

 Tools: Nmap, Netcat.
 Types: TCP Scan, SYN Scan, FIN Scan.
 Purpose: Identify services running.

2. Network Scanning:

 Finds active hosts and IP addresses.

 Tools: Angry IP Scanner, Nmap.
 Purpose: Map network topology.

3. Vulnerability Scanning:

 Searches for known vulnerabilities.

 Tools: Nessus, OpenVAS.
 Output: CVE listings, severity ratings.

4. OS Scanning / Fingerprinting:

 Determines OS and version.

 Tools: Xprobe, Nmap.
 Purpose: Tailor exploits accordingly.

5. Stealth Scanning:

 Avoids detection by firewalls.

 Techniques: NULL scan, Xmas scan.
 Use Case: Evade IDS/IPS.

6. Ping Sweep:

 Detects live systems on the network.

 Tools: fping, ping.

7. Application Scanning:

 Checks vulnerabilities in apps.

 Tools: Nikto, Burp Suite.


14. a) (i) Distinguish between the HBID and NBID (7 Marks)

 Intrusion Detection Systems (IDS) are broadly classified into two types based
on their deployment location and monitoring approach:

1. Host-Based Intrusion Detection System (HBID)

2. Network-Based Intrusion Detection System (NBID)

Criteria Host-Based IDS (HBID) Network-Based IDS (NBID)

Deployed at network perimeters or

Installed on individual hosts (e.g.,
Location strategic points (e.g., routers,
servers, PCs)
gateways)

Monitors system-level activities Monitors network traffic (packets,

Monitoring Scope
(file access, system calls, logs) protocols, flows)

Can analyze encrypted traffic on Cannot see encrypted traffic unless

Data Visibility
the host decrypted first

Attack Detection Detects insider threats, privilege Detects external attacks like port
Focus escalation, local malware scans, DoS, sniffing
Examples OSSEC, Tripwire, AIDE Snort, Suricata, Bro/Zeek
Consumes host system resources Runs on dedicated appliances;
Resource Usage
(CPU, memory) offloads host systems

Provides detailed user-level and Focuses on packet-level data and

Granularity
process-level visibility traffic behavior

Deployment Requires installation and Centralized deployment; easier for

Complexity configuration on each endpoint network-wide monitoring

Low false positives for local May generate more false positives
Alert Accuracy
activity from normal traffic fluctuations

Easier centralized updates and

Maintenance Requires frequent updates per host
management

Less scalable in large Scales better for large, distributed

Scalability
environments networks

Incident Good for forensic analysis Good for real-time network defense
Response (captures logs, file changes) and correlation
Monitoring DMZ, perimeter
Protecting mission-critical systems
Use Cases security, and detecting scanning
(e.g., databases, financial servers)
attempts

14. a) (ii) Write short notes on Host-Based Intrusion Detection (6 Marks)

 Host-Based Intrusion Detection System (HBID) is a security system deployed
on individual hosts (like servers or workstations) to monitor system behavior,
configuration changes, and data access in order to detect malicious activities and
policy violations.

Main Functions of HBID:

1. Log File Analysis:

Analyzes system event logs, audit logs, and application logs for signs of
intrusions such as failed login attempts, abnormal system calls, or privilege
escalations.
2. File Integrity Monitoring (FIM):
Continuously checks the integrity of critical system files and configuration
files. Alerts are triggered if unauthorized changes are detected (e.g., /etc/passwd,
registry keys).
3. System Call Monitoring:
Observes and records OS-level system calls made by processes. This helps
detect hidden malware (like rootkits) that manipulate system calls.
4. User Activity Monitoring:
Tracks user logins, session times, and access to sensitive files or tools. Helps
detect unauthorized access by insiders.
5. Configuration Auditing:
Detects mis-configurations that violate security policies, like disabled
antivirus or open remote desktop ports.

Advantages:

 Detects insider attacks and local threats.

 Effective on encrypted traffic because it operates at the host level.
 Offers high-resolution logging for forensic analysis.
 Useful in non-networked systems (e.g., air-gapped environments).

Disadvantages:

 Scalability challenges – requires installation and configuration on every

host.
 Consumes system resources (RAM, CPU).
 Cannot detect network-wide threats like port scans or DDoS.
 Difficult to manage in large enterprises without centralized tools.

Use Cases:

 Servers containing sensitive data (e.g., DB, payroll).

 Endpoints in healthcare or banking sectors.
 Insider threat monitoring.
 HBID is an essential layer of endpoint security, especially against insider
threats, policy violations, and malware that operates locally. When combined with
Network-Based IDS (NBID), it offers strong layered defense.

(OR)

14. b) (i) Explain the Intrusion Detection Exchange Format (IDXF) with a
suitable example (7 Marks)

The Intrusion Detection Exchange Format (IDXF), also known more formally
as IDMEF (Intrusion Detection Message Exchange Format), is an XML-based data
exchange standard used to share alerts and incident information between intrusion
detection and security systems. It enables automated and structured communication
among various security platforms.

It was developed by the Intrusion Detection Working Group of the IETF to

promote interoperability between diverse intrusion detection tools, firewalls, SIEMs
(Security Information and Event Management), and response systems.

Objectives of IDXF / IDMEF

 To provide a standardized format for reporting security events.

 To ensure cross-vendor compatibility of IDS alerts and logs.
 To enable automated alert processing and faster incident response.
 To support inter-organizational intelligence sharing in cybersecurity
operations.

Components of an IDXF Message

An IDXF alert is structured using XML and typically includes the following fields:

Component Description
Analyzer Identifies the IDS or system generating the alert
CreateTime Timestamp when the alert was created
DetectTime When the intrusion was detected
Source Information about the origin of the attack (IP, host-name)
Target The system or device being attacked
Classification Type of attack or threat detected
Assessment Severity, confidence level, and impact
Additional Data Optional field to attach logs, payloads, or protocols

Scenario/Use Case

Consider a corporate network using:

 1. Snort as its IDS,
2. Splunk as the SIEM,
3. FortiGate firewall.

When Snort detects suspicious packets (e.g., SQL injection), it generates an

IDXF alert. This alert is:

 Sent to Splunk via a standardized API.

 Correlated with other events (e.g., login failures).
 If confirmed, a rule is triggered in FortiGate to block the attacker’s IP.
 Simultaneously, an alert is sent to the SOC (Security Operations Center).

Advantages of IDXF

1. Standardization
2. Automation
3. Interoperability
4. Centralized Logging
5. Supports Threat Intelligence Sharing
6. Improves Incident Response Time

Limitations

 XML-based format can be verbose, increasing bandwidth and processing.

 Requires support and configuration in all participating tools.
 Not all legacy systems may fully support IDXF.

IDXF (or IDMEF) plays a critical role in today’s cyber defense infrastructure.
It allows intrusion detection systems to speak a common language, empowering
organizations to coordinate detection, analysis, and response across different
platforms. In an age of sophisticated attacks and zero-day threats, such standardized
communication formats are essential for agile, automated, and accurate security
operations.

14. b) (ii) Explain IDXF’s role in sharing threat intelligence across different
systems (6 Marks)
Intrusion Detection Exchange Format (IDXF), also known as IDMEF,
is a structured XML-based standard for exchanging cybersecurity incident data
between IDS, firewalls, SIEM systems, and threat intelligence platforms.

IDXF’s Role in Threat Intelligence Sharing:

1. Common Language for Security Systems:

IDXF creates a vendor-neutral format that allows tools from different vendors
(e.g., Snort, Fortinet, IBM QRadar) to understand and share threat data.
  Improves Collaboration Among Systems:
Allows a Network IDS to send threat alerts to a firewall or SIEM tool in real
time, helping block threats faster.
 Real-Time Alert Sharing:

When a suspicious activity is detected by one device (e.g., a DDoS attack), it

sends an alert using IDXF to other devices.

These alerts include data like attacker IP, target IP, protocol, attack signature,
and risk level.

2. Automation of Incident Response:

 IDXF enables security orchestration tools to take automated action like

blacklisting an IP or isolating a host.
 Reduces response time drastically.

3. Multi-Platform Integration:

Used in Security Information and Event Management (SIEM) systems like

Splunk, ArcSight, and IBM QRadar for correlation.

Can feed into Threat Intelligence Platforms (TIPs) for long-term analysis.

4. Ease of Forensics and Auditing:

 All incidents are logged in a structured and searchable format.

 Useful for generating compliance reports and post-breach investigations.

5. Supports Advanced Threat Sharing Initiatives:

 The alert is received by SIEM, which correlates it with other data.

 Firewall auto-blocks the source IP.

IDXF enables cross-system cooperation, faster incident response, and scalable

intelligence sharing. In modern networks with multiple security layers, IDXF plays a
key role in unifying threat awareness and defending against coordinated cyber attacks.

Here are expanded, exam-ready answers for the following CCS 340 – Cyber
Security questions:

✅ 15. a) (i) Explain the SYN Flood Attack.

How firewalls help to prevent it?
(13-mark version with diagram and real-world defenses)
Definition of SYN Flood Attack

A SYN flood attack is a type of Denial-of-Service (DoS) attack that targets the TCP
three-way handshake process to overwhelm and crash a server.

TCP Three-Way Handshake Process

1.

Client sends a SYN request to the server.

2.
3.

Server replies with SYN-ACK and waits for client’s ACK.

4.
5.

Client sends ACK, and the connection is established.

6.

How SYN Flood Works

The attacker sends a large number of SYN requests but does not complete
the handshake.




The server holds these half-open connections in memory.




Once the memory buffer fills up, legitimate users are denied service.

Consequences of SYN Flooding

 

High memory and CPU consumption.




Crashes in network services.




Downtime of websites, applications, and databases.

Firewall Countermeasures

🔹 1. SYN Cookies

Instead of allocating memory after SYN, the server encodes connection details
into a cookie and waits for ACK.




Memory is only used if ACK is received → mitigates half-open problem.

🔹 2. Rate Limiting

Limits the number of SYN packets per second from each IP.




Prevents a single IP from flooding the server.

🔹 3. SYN Proxy (Deep Packet Inspection)


 Firewall acts as a middle-man in the handshake.




Completes TCP handshake with client and only forwards valid connections to
the server.

🔹 4. Timeout Reduction

Reduces how long half-open connections are retained.




Releases system memory faster.

🔹 5. Geo-IP Filtering

Blocks or limits access from suspicious countries or regions.

Diagram of SYN Flood

Attacker Server
|-- SYN -------->|
| |-- SYN-ACK -->
| (No ACK) |
(repeats above) (connection stays half-open)

Memory fills up → new connections blocked.

Real-World Example

GitHub (2018) was hit by a massive SYN flood-style DDoS attack peaking at
1.35 Tbps, mitigated by proxy firewalls and Akamai's scrubbing center.
 

Conclusion

SYN floods exploit TCP’s connection model. Firewalls equipped with SYN cookies,
rate-limiting, and connection management can effectively neutralize these attacks
and maintain service availability.

✅ 15. a) (ii) What is Unified Threat

Management (UTM)? Describe its
features.

Definition

Unified Threat Management (UTM) is an all-in-one security appliance that

integrates multiple network security features into a single hardware or software
solution.

Key Features of UTM

1.

🔐 Firewall

2.

Packet filtering, stateful inspection.

3.

🛡 Intrusion Detection & Prevention (IDS/IPS)

4.

o
 Detects and blocks unauthorized access attempts.

5.

🦠 Anti-Virus & Anti-Spyware

6.

Scans incoming/outgoing traffic for malware.

7.

🌐 Web Content Filtering

8.

Blocks access to malicious or inappropriate websites.

9.

✉️Email Security

10.

Prevents spam, phishing, and malicious attachments.

11.

🔗 VPN (Virtual Private Network)

12.

Secure remote access using encryption (IPSec, SSL).

 o

13.

⚙ Application Control

14.

Controls use of apps like Skype, YouTube, or torrents.

15.

📈 Logging and Reporting

16.

Centralized dashboard for monitoring all security layers.

Benefits of UTM

Cost-effective: Reduces need for multiple devices.




Simplified management: One console for all security controls.




Scalable: Easily upgradable for growing businesses.




Improved compliance: Centralized logs help with audits.

 

Limitations

Single point of failure: If UTM is compromised, all services are at risk.




Performance impact: All-in-one may slow down during peak loads.

Examples of UTM Vendors

Fortinet FortiGate




Sophos XG




SonicWall




WatchGuard

Conclusion

UTM offers a layered, unified, and cost-efficient approach to security, making it

ideal for SMEs and organizations needing streamlined cybersecurity.
✅ 15. b) (i) Discuss how firewalls are
deployed and techniques used to allow
authorized traffic.

Firewall Deployment Strategies

1.

🔲 Perimeter Deployment

2.

Positioned between the internal network and the internet.

o
o

First line of defense (e.g., external firewall).

3.

🧱 Internal Segmentation

4.

Firewalls between departments (e.g., HR vs. R&D) to control lateral

movement.

5.

🌐 DMZ (Demilitarized Zone) Deployment

6.

o
 Web, mail, or DNS servers placed in a semi-exposed zone.

o
o

Traffic to/from DMZ is tightly controlled.

7.

🌍 Cloud/Virtual Firewall Deployment

8.

In cloud environments like AWS or Azure using software-defined

firewalls.

Techniques to Allow Authorized Traffic

1.

✅ Access Control Lists (ACLs)

2.

Rules based on IP address, port, or protocol.

3.

🌍 Stateful Inspection

4.

Monitors the state of active connections (more secure than static

ACLs).
 o

5.

📌 Whitelisting

6.

Only predefined trusted sources are allowed (e.g., VPN IPs, office
devices).

7.

🧠 Deep Packet Inspection (DPI)

8.

Inspects the contents of the packet for policy violations.

9.

🕒 Time-Based Rules

10.

Permit access only during business hours.

11.

🧠 User Identity Rules

12.

Uses LDAP or Active Directory to allow traffic based on user roles.

 o

13.

📑 Geo-IP Filtering

14.

Allows access from specific countries or blocks suspicious regions.

Best Practices

Use least privilege principles.




Apply logging and monitoring to all firewall rules.




Regularly review and update rules based on new risks.

Conclusion

Proper deployment of firewalls and fine-grained traffic control ensures strong

network defense without obstructing legitimate users.

✅ 15. b) (ii) Explain firewall and IPS

deployment considerations.
Key Considerations When Deploying Firewalls and IPS

1. ⚙ Network Topology and Placement

Place firewalls at network entry/exit points.




Use IPS inline after the firewall for deep inspection.




Use out-of-band mode for detection-only if performance is a concern.

2. 🚦 Performance and Throughput

Choose hardware that can handle peak load (e.g., 10 Gbps networks).




IPS must support real-time packet analysis without delay.

3. 🔐 Policy Granularity

Implement layered rules (port, application, user, location).




Use IPS signatures and behavior rules tailored to environment.

 

4. 🔁 Redundancy and Failover

Use HA (High Availability) firewalls with failover pairs.




IPS should have fail-open mode in case of hardware failure.

5. 🧩 Integration with SIEM and SOC

Forward logs and alerts to SIEM for correlation.




Enables faster detection and response (e.g., Splunk, QRadar).

6. 📈 Scalability and Upgradability

Plan for future expansion—modular or clustered firewalls.




IPS engines should support signature updates and AI models.

7. Ease of Management
 

Centralized GUI/CLI with logging and visualization.




Role-based access for rule changes and monitoring.

Conclusion

Successful deployment of firewalls and IPS requires careful planning of location,

performance, policy, and scalability. When implemented properly, they form a
robust, responsive security architecture.

✅ 16. a) (i) Compare Signature-Based

IDS and Anomaly-Based IDS. Which is
better for detecting zero-day attacks?

Signature-Based
Feature Anomaly-Based IDS
IDS
Matches known Detects deviations from normal
Detection
patterns or signatures behavior
High for known Good for unknown attacks,
Accuracy
attacks prone to false positives
Requires frequent Needs a well-trained normal
Maintenance
signature updates behavior model
Zero-Day Ineffective unless Effective—flags unusual
Attacks signature exists behavior
False
Low High if training is poor
Positives
Response Fast for known
Slower, needs analysis
Time threats
Examples Snort, Suricata Bro/Zeek, Cisco Stealthwatch

Zero-Day Detection


 Anomaly-based IDS is superior for detecting zero-day attacks as it does not
rely on signatures, instead identifying abnormal activity.




Example: A machine begins communicating with an unknown domain or

transferring large files at midnight → flagged as anomaly.

Hybrid Approach

Many organizations combine both to benefit from:

Low false positives (signature-based).




Unknown attack detection (anomaly-based).

Conclusion

Anomaly-based IDS is more suitable for zero-day detection, but the ideal strategy is
to use a hybrid IDS setup for layered security.

✅ 16. a) (ii) Discuss how scanning tools

like Nmap help identify vulnerable
systems.

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool used for network discovery,
scanning, and vulnerability assessment.
Key Scanning Techniques in Nmap

1.

🔎 Port Scanning

2.

Detects open/closed ports.

o
o

Command: nmap -sS [Link]

3.

🧠 Service & Version Detection

4.

Identifies services and software version.

o
o

nmap -sV [Link]

5.

🧬 OS Detection

6.

Guesses operating system based on packet responses.

o
 o

nmap -O [Link]

7.

🧰 Script Scanning (NSE)

8.

Runs vulnerability or brute-force scripts.

o
o

nmap --script=vuln [Link]

9.

🔧 Ping Sweep

10.

Identifies live hosts.

o
o

nmap -sn [Link]/24

11.

🚪 Stealth Scans

12.

-sS, -sN, -sX avoid detection by firewalls/IDS.

 o

Use in Vulnerability Assessment

Discover exposed services (e.g., open FTP or Telnet).




Detect outdated versions of web servers, DNS, etc.




Identify default or weak configurations.

Example Scenario

You scan a network and find a system running:

Windows XP

o
o

SMBv1

Indicates vulnerability to EternalBlue exploit.


Ethical Use

Used by penetration testers and security analysts.




Should never be used without permission → may trigger alerts.

Conclusion

Tools like Nmap are critical for identifying entry points and weaknesses in systems.
When used ethically, they strengthen security posture and prevent real attacks.

Let me know if you'd like a downloadable PDF of all answers or help with Part C
questions next!

Here is the complete 15-mark answer for Question 16 (b) from Page 3 of the CCS
340 – Cyber Security exam, split into parts (i) and (ii), with detailed points suitable
for university exam writing.

✅ 16. b) (i) Identify and explain the

common web application attacks that
could have been used to exploit XYZ
Technologies' e-commerce platform.
(8 Marks)

Introduction
Web applications, especially e-commerce platforms like XYZ Technologies’, are
prime targets for attackers due to the presence of sensitive data such as user
credentials, credit card numbers, and payment details. Attackers use various web
vulnerabilities to gain unauthorized access, perform fraud, or damage brand
reputation.

Common Web Application Attacks

1. SQL Injection (SQLi)

Description: Attacker inserts malicious SQL code into input fields (e.g., login
forms) to manipulate the database.




Impact: Data leakage, unauthorized access, deletion of data.




Example:

' OR '1'='1

could allow an attacker to log in without credentials.

2. Cross-Site Scripting (XSS)

Description: Involves injecting malicious JavaScript into a web page that is

viewed by other users.



 Impact: Session hijacking, stealing cookies, redirecting users to fake pages.




Example:

<script>alert('Hacked!');</script>

3. Cross-Site Request Forgery (CSRF)

Description: Forces a logged-in user to perform unwanted actions on a web

app (e.g., fund transfer).




Impact: Unauthorized operations like account changes or purchases.

4. Broken Authentication

Description: Flawed session management allows attackers to impersonate

users.




Impact: Account takeover, unauthorized transactions.

5. Insecure Direct Object References (IDOR)

 

Description: Exploiting predictable URLs to access other users' data.




Impact: Privacy violation.




Example: Accessing /invoice/1001 instead of /invoice/1002.

6. Command Injection

Description: User input is interpreted as OS commands.




Impact: Full control over server OS.

7. File Upload Vulnerability

Description: Malicious file (like a PHP shell) is uploaded via a form.




Impact: Remote code execution.

8. Security Misconfigurations
 

Examples: Default admin credentials, open directory listing.




Impact: Easy exploitation due to improper setup.

Conclusion

E-commerce sites are vulnerable to a variety of attacks. Without proper validation,

access control, and secure coding, attackers can exploit these weaknesses and cause
serious damage to user data and business operations.

✅ 16. b) (ii) Suggest specific

countermeasures that XYZ Technologies
should implement to prevent these web
application attacks.
(7 Marks)

Recommended Countermeasures

1. Input Validation and Output Encoding

Use server-side validation to check data format, length, and type.




Apply output encoding to neutralize scripts in output (prevents XSS).


2. Use Prepared Statements / Parameterized Queries

Prevent SQL Injection by using secure functions (e.g., PDO in PHP,

PreparedStatement in Java).




Example:

$stmt = $pdo->prepare("SELECT * FROM users WHERE email = ?");

$stmt->execute([$email]);

3. Implement Strong Authentication Mechanisms

Enforce multi-factor authentication (MFA).




Use secure session management (unique tokens, expiration, HTTPS-only).

4. Use CSRF Tokens

Embed a unique token in each form that must match the server’s token.




Ensures user actions are intentional.


5. Access Control & Least Privilege

Implement role-based access control (RBAC).




Prevent users from accessing unauthorized data or actions.

6. Secure File Uploads

Allow only specific file types.




Rename uploaded files, store outside the root directory.




Scan files for malware.

7. Security Headers

Implement headers like:

Content-Security-Policy
 o
o

X-Frame-Options

o
o

Strict-Transport-Security

8. Regular Penetration Testing and Vulnerability

Scanning

Use tools like OWASP ZAP, Burp Suite, and Nessus.




Identify and fix known vulnerabilities before attackers do.

9. Patch Management

Regularly update web servers, CMS, plugins, and libraries.

10. Web Application Firewall (WAF)

Filter and monitor HTTP traffic.



 Blocks known attack patterns (SQLi, XSS, etc.).

Conclusion

To protect against common web attacks, XYZ Technologies must adopt a security-
first development approach, implement proper coding practices, deploy defensive
tools like WAFs, and conduct regular testing. Proactive security will ensure trust, data
privacy, and business continuity.

Would you like me to compile all 16 questions and answers into a formatted PDF
for revision or submission?