Firewall Technologies and IDS/IPS Flashcards

Which firewall type inspects the full context of a TCP session rather than individual packets?

Answer: Stateful inspection firewall

A stateful firewall tracks the state of active connections and uses this context to determine whether packets belong to a legitimate session.

What distinguishes a next-generation firewall (NGFW) from a traditional stateful firewall?

Answer: NGFW adds application-layer inspection, user identity awareness, and integrated IPS

An NGFW combines stateful inspection with deep packet inspection, application identification, user-based policies, and IPS capabilities.

An IDS detects a known attack signature. What is the IMMEDIATE response it takes by default?

Answer: Sends an alert to the administrator

An IDS (Intrusion Detection System) is a passive device that generates alerts; it does not block traffic by default.

Which IDS/IPS detection method identifies attacks by comparing traffic to known bad patterns?

Answer: Signature-based detection

Signature-based detection matches traffic against a database of known attack patterns, making it effective against known threats.

A firewall rule set should follow which ordering principle for efficiency and security?

Answer: Most specific rules first, with a deny-all at the bottom

Specific rules should precede general ones, and an implicit or explicit deny-all at the end ensures no unauthorized traffic passes.

What is the primary risk of placing an IDS sensor outside the perimeter firewall?

Answer: It generates excessive false positives from internet noise but misses post-filter attacks

An external IDS sees all raw internet traffic, producing high false-positive rates, but traffic blocked by the firewall never reaches internal systems.