The ________ is an audit collection module operating as a background process on a monitored system whose purpose is to collect data on security related events on the host and transmit these to the central manager.
A. central manager module B. host agent module
C. intruder alert module D. LAN monitor agent module
Question 2
The _________ is based on a judgment of what is considered abnormal rather than an automated analysis of past audit records.
A. Markov process B. mean and standard deviation
C. time series D. operational model
