CCP Firewall & IDS/IPS Tuning 2

Question 1

A security team notices their IDS is generating thousands of alerts per day but analysts can only investigate 50. Which tuning strategy best addresses this alert fatigue?

Accepted Answer

Implement risk-based alert prioritization and suppress known-good traffic baselines

Answer

Risk-based prioritization combined with baselining known-good traffic reduces noise while preserving detection of genuine threats.

Question 2

Which firewall rule placement principle ensures the most specific rules are evaluated before broader catch-all rules?

Accepted Answer

Most specific rules placed first in the ACL

Answer

Firewalls process rules top-down, so placing the most specific rules first ensures precise matching before broader rules can incorrectly capture traffic.

Question 3

An IPS is blocking legitimate business traffic to a critical application. What is the FIRST step to resolve this while maintaining security?

Accepted Answer

Create a tuned exception or exclusion for the specific source-destination pair

Answer

Creating a scoped exception for the specific traffic pair resolves the false positive without broadly reducing detection capability.

Question 4

What does the term 'stateful inspection' refer to in next-generation firewall operation?

Accepted Answer

Tracking the state of active connections to validate packets belong to established sessions

Answer

Stateful inspection tracks connection state tables so only packets that are part of legitimate established sessions are permitted through.

Question 5

A network IDS deployed in promiscuous mode detects an attack but the malicious traffic has already reached its destination. What does this scenario illustrate?

Accepted Answer

The difference between IDS (detect only) and IPS (inline blocking)

Answer

An IDS in promiscuous mode observes a copy of traffic and can only alert after the fact, whereas an IPS sits inline and can block traffic in real time.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP Firewall & IDS/IPS Tuning 2