Firewall Technologies and IDS/IPS Flashcards

Which type of firewall architecture uses a separate proxy process for each application protocol?

Answer: Application proxy (circuit-level gateway)

An application proxy firewall terminates connections and creates new ones, fully understanding each protocol to enforce granular policies.

What does 'false positive' mean in the context of an IDS?

Answer: A legitimate activity that is incorrectly flagged as malicious

A false positive occurs when benign traffic triggers an alert, wasting analyst time and potentially leading to alert fatigue.

Which IPS deployment mode allows it to actively block malicious traffic inline?

Answer: Inline mode between network segments

Inline IPS sits in the traffic path and can drop or modify packets before they reach the destination.

A CNDA needs to inspect encrypted HTTPS traffic for malware. Which firewall capability is required?

Answer: SSL/TLS inspection (deep packet inspection)

SSL/TLS inspection decrypts, inspects, and re-encrypts traffic so the firewall can examine encrypted payloads for threats.

What firewall feature prevents internal hosts from using unauthorized DNS servers?

Answer: DNS proxy or DNS inspection policy

A DNS inspection policy on the firewall can intercept and redirect DNS queries to approved resolvers, preventing DNS tunneling and C2 communication.

Which attack type is specifically designed to evade signature-based IDS by breaking payloads across multiple packets?

Answer: Fragmentation attack

Fragmentation attacks split malicious payloads across multiple IP fragments so no single fragment matches a complete signature.