1. They’re most like burglar alarms, because they’re both setup to detect intruders and alert users when a threat is detected. 2. A false positive seems like an alert. False negatives seem like normal activity. False positives are just a problem, and false negatives are failures in the systems. 3. A network-based IDPS monitors traffic, and host-based IDPS stays on a particular computer or server and monitors that system. 4. Signature-based IDPS examine data traffic for patterns that match signatures, and behavior-based IDPS collect data from normal traffic and establish a baseline. 5. A switched-port analysis port is a data port on a switched device that copies all designated traffic from the switch device so the traffic can be stored and analyzed for IDPS. 6. In the Centralized control strategy all IDPS control functions are implemented and managed in a central location. Fully-Distributed is the opposite of Centralized, and in this strategy each monitoring site uses its own paired sensors to perform its own control functions to complete necessary detection, reaction, and response functions. 7. Honeypots are decoy systems designed to lure potential attackers away from critical systems. When more than one honeypot is connected to a number of honey pot systems on a subnet it’s called a honeynet. 8. A padded-cell is a tougher honeypot, when its detected attackers it smoothly sends them to a special stimulated environment where they can no longer cause harm. 9. Network footprinting is the organized research of the internet addresses owned or controlled by a target organization. 10. Network fingerprinting is a survey of all the target organization’s internet addresses that are collected during footprinting. 11. Fingerprinting relies on footprinting for data 12. Because it is high-impact and a highly intensive use of network