Firewall Technologies and IDS/IPS Flashcards

What is the purpose of a 'stateful failover' configuration in a firewall cluster?

Answer: To replicate connection state tables so sessions survive a failover without dropping

Stateful failover synchronizes active session tables between firewall peers so existing connections continue seamlessly if the active unit fails.

Which technique allows a host-based IDS (HIDS) to detect file system tampering?

Answer: File integrity monitoring (FIM) using cryptographic hashes

HIDS uses FIM to hash critical files at baseline and alerts when hashes change, indicating unauthorized modification.

An attacker sends thousands of half-open TCP connections to overwhelm a server. Which firewall feature mitigates this?

Answer: SYN proxy or SYN cookies

A SYN proxy intercepts TCP handshakes and only forwards complete connections to the server, protecting against SYN flood attacks.

What is the key advantage of anomaly-based IDS over signature-based IDS?

Answer: Ability to detect zero-day and previously unknown attacks

Anomaly-based IDS detects deviations from established baselines, enabling detection of novel attacks that have no known signatures.

Which firewall policy approach explicitly denies all traffic that is not permitted by a specific rule?

Answer: Default deny (deny-all) policy

A default deny policy blocks all traffic unless explicitly allowed, implementing the principle of least privilege at the network level.

In a CNDA context, what is 'threat normalization' as it applies to IDS?

Answer: Reassembling fragmented or evasion-altered traffic to its true form before inspection

Threat normalization reconstructs traffic that has been obfuscated through fragmentation or encoding so signatures can match it accurately.