CNDA Firewall Technologies and IDS/IPS 2 — Questions and Answers
Question 1: Which type of firewall architecture uses a separate proxy process for each application protocol?
- Stateful firewall
- Packet filter
- Application proxy (circuit-level gateway) (Correct answer)
- Deep packet inspection engine
Correct answer: Application proxy (circuit-level gateway)
An application proxy firewall terminates connections and creates new ones, fully understanding each protocol to enforce granular policies.
Question 2: What does 'false positive' mean in the context of an IDS?
- An attack that was not detected
- A legitimate activity that is incorrectly flagged as malicious (Correct answer)
- A rule that always matches
- An alert with no log entry
Correct answer: A legitimate activity that is incorrectly flagged as malicious
A false positive occurs when benign traffic triggers an alert, wasting analyst time and potentially leading to alert fatigue.
Question 3: Which IPS deployment mode allows it to actively block malicious traffic inline?
- Passive (promiscuous) mode
- Inline mode between network segments (Correct answer)
- Port mirroring mode
- Out-of-band mode
Correct answer: Inline mode between network segments
Inline IPS sits in the traffic path and can drop or modify packets before they reach the destination.
Question 4: A CNDA needs to inspect encrypted HTTPS traffic for malware. Which firewall capability is required?
- NAT overload
- SSL/TLS inspection (deep packet inspection) (Correct answer)
- URL filtering
- Geo-blocking
Correct answer: SSL/TLS inspection (deep packet inspection)
SSL/TLS inspection decrypts, inspects, and re-encrypts traffic so the firewall can examine encrypted payloads for threats.
Question 5: What firewall feature prevents internal hosts from using unauthorized DNS servers?
- DNS sinkholing
- DNS proxy or DNS inspection policy (Correct answer)
- DNSSEC validation
- Split DNS
Correct answer: DNS proxy or DNS inspection policy
A DNS inspection policy on the firewall can intercept and redirect DNS queries to approved resolvers, preventing DNS tunneling and C2 communication.
Question 6: Which attack type is specifically designed to evade signature-based IDS by breaking payloads across multiple packets?
- SQL injection
- Fragmentation attack (Correct answer)
- Replay attack
- Man-in-the-middle attack
Correct answer: Fragmentation attack
Fragmentation attacks split malicious payloads across multiple IP fragments so no single fragment matches a complete signature.
CNDA Firewall Technologies and IDS/IPS 2
Which type of firewall architecture uses a separate proxy process for each application protocol?