CNDA Firewall Technologies and IDS/IPS 2

Question 1

Which type of firewall architecture uses a separate proxy process for each application protocol?

Accepted Answer

Application proxy (circuit-level gateway)

Answer

An application proxy firewall terminates connections and creates new ones, fully understanding each protocol to enforce granular policies.

Question 2

What does 'false positive' mean in the context of an IDS?

Accepted Answer

A legitimate activity that is incorrectly flagged as malicious

Answer

A false positive occurs when benign traffic triggers an alert, wasting analyst time and potentially leading to alert fatigue.

Question 3

Which IPS deployment mode allows it to actively block malicious traffic inline?

Accepted Answer

Inline mode between network segments

Answer

Inline IPS sits in the traffic path and can drop or modify packets before they reach the destination.

Question 4

A CNDA needs to inspect encrypted HTTPS traffic for malware. Which firewall capability is required?

Accepted Answer

SSL/TLS inspection (deep packet inspection)

Answer

SSL/TLS inspection decrypts, inspects, and re-encrypts traffic so the firewall can examine encrypted payloads for threats.

Question 5

What firewall feature prevents internal hosts from using unauthorized DNS servers?

Accepted Answer

DNS proxy or DNS inspection policy

Answer

A DNS inspection policy on the firewall can intercept and redirect DNS queries to approved resolvers, preventing DNS tunneling and C2 communication.

CNDA - Certified Network Defense Architect Practice Test