CCP Firewall & IDS/IPS Tuning 2 — Questions and Answers
Question 1: A security team notices their IDS is generating thousands of alerts per day but analysts can only investigate 50. Which tuning strategy best addresses this alert fatigue?
- Disable all low-severity rules
- Implement risk-based alert prioritization and suppress known-good traffic baselines (Correct answer)
- Increase analyst headcount only
- Switch from signature-based to anomaly-based detection exclusively
Correct answer: Implement risk-based alert prioritization and suppress known-good traffic baselines
Risk-based prioritization combined with baselining known-good traffic reduces noise while preserving detection of genuine threats.
Question 2: Which firewall rule placement principle ensures the most specific rules are evaluated before broader catch-all rules?
- Default-deny at the top
- Most specific rules placed first in the ACL (Correct answer)
- Rules ordered by protocol type
- Outbound rules before inbound rules
Correct answer: Most specific rules placed first in the ACL
Firewalls process rules top-down, so placing the most specific rules first ensures precise matching before broader rules can incorrectly capture traffic.
Question 3: An IPS is blocking legitimate business traffic to a critical application. What is the FIRST step to resolve this while maintaining security?
- Disable the IPS temporarily
- Create a tuned exception or exclusion for the specific source-destination pair (Correct answer)
- Switch the IPS to detection-only mode permanently
- Remove the triggering signature entirely
Correct answer: Create a tuned exception or exclusion for the specific source-destination pair
Creating a scoped exception for the specific traffic pair resolves the false positive without broadly reducing detection capability.
Question 4: What does the term 'stateful inspection' refer to in next-generation firewall operation?
- Inspecting only packet headers for IP addresses
- Tracking the state of active connections to validate packets belong to established sessions (Correct answer)
- Inspecting application-layer payloads only
- Maintaining a static list of allowed IP addresses
Correct answer: Tracking the state of active connections to validate packets belong to established sessions
Stateful inspection tracks connection state tables so only packets that are part of legitimate established sessions are permitted through.
Question 5: A network IDS deployed in promiscuous mode detects an attack but the malicious traffic has already reached its destination. What does this scenario illustrate?
- A limitation of host-based IDS
- The difference between IDS (detect only) and IPS (inline blocking) (Correct answer)
- A failure of signature updates
- An advantage of network-based IDS over IPS
Correct answer: The difference between IDS (detect only) and IPS (inline blocking)
An IDS in promiscuous mode observes a copy of traffic and can only alert after the fact, whereas an IPS sits inline and can block traffic in real time.
Question 6: Which metric is MOST useful for evaluating IDS tuning effectiveness over time?
- Total number of signatures enabled
- False positive rate and mean time to detect (MTTD) (Correct answer)
- Number of alerts generated per day
- Volume of network traffic analyzed
Correct answer: False positive rate and mean time to detect (MTTD)
False positive rate and MTTD together measure both accuracy and speed of detection, making them the best indicators of tuning effectiveness.
Question 7: A firewall administrator wants to log all denied traffic without impacting performance. Which approach is MOST appropriate?
- Log all traffic at the firewall processor level
- Use asynchronous logging to an external syslog server (Correct answer)
- Enable logging only on permit rules
- Store logs locally in RAM only
Correct answer: Use asynchronous logging to an external syslog server
Asynchronous logging offloads log writing to an external syslog server, preventing log I/O from consuming firewall CPU and memory resources.
CCP Firewall & IDS/IPS Tuning 2
A security team notices their IDS is generating thousands of alerts per day but analysts can only investigate 50.
Which tuning strategy best addresses this alert fatigue?