CCP Firewall & IDS/IPS Tuning 3

Question 1

Which IDS/IPS evasion technique involves splitting malicious payload across multiple TCP segments to avoid signature matching?

Accepted Answer

Fragmentation and session splicing

Answer

Session splicing breaks a payload across multiple small TCP segments, exploiting IDS systems that do not reassemble streams before pattern matching.

Question 2

An organization deploys a Web Application Firewall (WAF) in front of its API gateway. What type of attack is the WAF LEAST suited to prevent without additional tuning?

Accepted Answer

Business logic abuse specific to the application

Answer

WAFs excel at pattern-based attack detection but cannot understand application-specific business logic, making logic abuse attacks like excessive API calls hard to detect without custom rules.

Question 3

What is the purpose of a 'tarpit' or honeypot integrated with an IPS response?

Accepted Answer

To slow down or trap attackers while gathering intelligence on their methods

Answer

A tarpit or honeypot deliberately engages attackers to waste their time and collect intelligence without exposing real assets.

Question 4

A NGFW is configured with application-layer inspection. Which OSI layer does it inspect beyond traditional packet filtering?

Accepted Answer

Layer 7 (Application)

Answer

Next-generation firewalls add Layer 7 application-layer inspection, enabling them to identify and control specific applications regardless of port.

Question 5

When tuning IDS rules for a PCI DSS environment, which traffic type should ALWAYS generate an alert regardless of baseline suppression settings?

Accepted Answer

Cleartext transmission of cardholder data outside the CDE

Answer

PCI DSS requires detection of cleartext cardholder data transmission outside the cardholder data environment as a mandatory compliance control.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP Firewall & IDS/IPS Tuning 3