CCP Firewall & IDS/IPS Tuning 3 — Questions and Answers
Question 1: Which IDS/IPS evasion technique involves splitting malicious payload across multiple TCP segments to avoid signature matching?
- Protocol tunneling
- Fragmentation and session splicing (Correct answer)
- Polymorphic shellcode
- Slow-rate scanning
Correct answer: Fragmentation and session splicing
Session splicing breaks a payload across multiple small TCP segments, exploiting IDS systems that do not reassemble streams before pattern matching.
Question 2: An organization deploys a Web Application Firewall (WAF) in front of its API gateway. What type of attack is the WAF LEAST suited to prevent without additional tuning?
- SQL injection in HTTP parameters
- Cross-site scripting (XSS)
- Business logic abuse specific to the application (Correct answer)
- OWASP Top 10 web vulnerabilities
Correct answer: Business logic abuse specific to the application
WAFs excel at pattern-based attack detection but cannot understand application-specific business logic, making logic abuse attacks like excessive API calls hard to detect without custom rules.
Question 3: What is the purpose of a 'tarpit' or honeypot integrated with an IPS response?
- To speed up legitimate traffic processing
- To slow down or trap attackers while gathering intelligence on their methods (Correct answer)
- To decrypt SSL/TLS for deep inspection
- To replace firewall ACLs with behavior-based rules
Correct answer: To slow down or trap attackers while gathering intelligence on their methods
A tarpit or honeypot deliberately engages attackers to waste their time and collect intelligence without exposing real assets.
Question 4: A NGFW is configured with application-layer inspection. Which OSI layer does it inspect beyond traditional packet filtering?
- Layer 2 (Data Link)
- Layer 3 (Network) only
- Layer 7 (Application) (Correct answer)
- Layer 5 (Session) only
Correct answer: Layer 7 (Application)
Next-generation firewalls add Layer 7 application-layer inspection, enabling them to identify and control specific applications regardless of port.
Question 5: When tuning IDS rules for a PCI DSS environment, which traffic type should ALWAYS generate an alert regardless of baseline suppression settings?
- ICMP echo requests within the internal network
- Cleartext transmission of cardholder data outside the CDE (Correct answer)
- DNS queries to internal resolvers
- DHCP traffic on the management VLAN
Correct answer: Cleartext transmission of cardholder data outside the CDE
PCI DSS requires detection of cleartext cardholder data transmission outside the cardholder data environment as a mandatory compliance control.
Question 6: An administrator notices that an IPS signature for a CVE is triggering on encrypted HTTPS traffic without SSL inspection enabled. What is the MOST likely cause?
- The signature is matching on TCP header anomalies rather than payload (Correct answer)
- The IPS is incorrectly decrypting traffic without a certificate
- The CVE affects only unencrypted protocols
- The signature file is corrupt
Correct answer: The signature is matching on TCP header anomalies rather than payload
Without SSL/TLS inspection, an IPS cannot read encrypted payloads, so any match must be based on observable network-layer characteristics like TCP behavior or certificate metadata.
Question 7: Which firewall architecture places a screened subnet between two firewalls to host public-facing services?
- Single-homed bastion host
- Dual-homed host firewall
- DMZ (Demilitarized Zone) architecture (Correct answer)
- Packet-filtering router only
Correct answer: DMZ (Demilitarized Zone) architecture
A DMZ architecture uses two firewalls to create an isolated segment where public services are hosted, limiting exposure of the internal network even if a DMZ host is compromised.
CCP Firewall & IDS/IPS Tuning 3
Which IDS/IPS evasion technique involves splitting malicious payload across multiple TCP segments to avoid signature matching?