The correct answer is "Acquires data to establish a normal system operating profile". A statistical anomaly-based intrusion detection system acquires data to establish a normal system operating profile.
Answer "Refers to a database of known attack signatures" is incorrect because it is used in signature-based intrusion detection. Answer "Will detect an attack that does not significantly change the system's operating characteristics." is incorrect because a statistical anomaly-based intrusion detection system will not detect an attack that does not significantly change the system operating characteristics. Similarly, answer "Does not report an event that caused a momentary anomaly in the system." is incorrect because the statistical anomaly-based IDS is susceptible to reporting an event that caused a momentary anomaly in the system.

Section: Software Development Security

"It is very important that the person, or people, conducting the forensics investigation is skilled in this trade and knows what to look out for. If a person reboots the attacked system or goes around looking at different files, it could corrupt viable evidence, change timestamps on key files, and erase footprints the criminal may have left. One very good first step is to make a sound image of the attacked system and perform forensic analysis on this copy. This will ensure that the evidence stays unharmed on the original system in case some steps in the investigation actually corrupt or destroy data. Also the memory of the system should be dumped to a file before doing any work on the system or powering it down." - Shon Harris All-in-one CISSP Certification Guide pg 672-673
PCMCIA to SCSI and parallel to SCSI forensic products can be found at the following vendor. http://www.icsforensic.com/products_cat_fr.cfm

Zone transfer is method that DNS uses to transfer zone information between servers. In some un-secure DNS installations zone transfers are allowed to un-trusted DNS servers. This allows the hacker to determine internal host names and ip addresses to provide additional information for an attack.