CNDA Firewall Technologies and IDS/IPS 2

Question 1

Which type of firewall architecture uses a separate proxy process for each application protocol?

Accepted Answer

Application proxy (circuit-level gateway)

Answer

Stateful firewall

Answer

Packet filter

Answer

Deep packet inspection engine

Question 2

What does 'false positive' mean in the context of an IDS?

Accepted Answer

A legitimate activity that is incorrectly flagged as malicious

Answer

An attack that was not detected

Answer

A rule that always matches

Answer

An alert with no log entry

Question 3

Which IPS deployment mode allows it to actively block malicious traffic inline?

Accepted Answer

Inline mode between network segments

Answer

Passive (promiscuous) mode

Answer

Port mirroring mode

Answer

Out-of-band mode

Question 4

A CNDA needs to inspect encrypted HTTPS traffic for malware. Which firewall capability is required?

Accepted Answer

SSL/TLS inspection (deep packet inspection)

Answer

NAT overload

Answer

URL filtering

Answer

Geo-blocking

Question 5

What firewall feature prevents internal hosts from using unauthorized DNS servers?

Accepted Answer

DNS proxy or DNS inspection policy

Answer

DNS sinkholing

Answer

DNSSEC validation

Answer

Split DNS

Question 6

Which attack type is specifically designed to evade signature-based IDS by breaking payloads across multiple packets?

Accepted Answer

Fragmentation attack

Answer

SQL injection

Answer

Replay attack

Answer

Man-in-the-middle attack