CNDA Firewall Technologies and IDS/IPS 3

Question 1

What is the purpose of a 'stateful failover' configuration in a firewall cluster?

Accepted Answer

To replicate connection state tables so sessions survive a failover without dropping

Answer

To synchronize firewall rules only

Answer

To load balance new connections

Answer

To back up firewall logs

Question 2

Which technique allows a host-based IDS (HIDS) to detect file system tampering?

Accepted Answer

File integrity monitoring (FIM) using cryptographic hashes

Answer

Network packet capture

Answer

Protocol analysis

Answer

Signature scanning of running processes

Question 3

An attacker sends thousands of half-open TCP connections to overwhelm a server. Which firewall feature mitigates this?

Accepted Answer

SYN proxy or SYN cookies

Answer

URL filtering

Answer

Application inspection

Answer

Content filtering

Question 4

What is the key advantage of anomaly-based IDS over signature-based IDS?

Accepted Answer

Ability to detect zero-day and previously unknown attacks

Answer

Lower false positive rate

Answer

Faster processing speed

Answer

Simpler rule management

Question 5

Which firewall policy approach explicitly denies all traffic that is not permitted by a specific rule?

Accepted Answer

Default deny (deny-all) policy

Answer

Default allow policy

Answer

Implicit permit

Answer

Stateless filtering

Question 6

In a CNDA context, what is 'threat normalization' as it applies to IDS?

Accepted Answer

Reassembling fragmented or evasion-altered traffic to its true form before inspection

Answer

Reducing alert severity ratings

Answer

Normalizing network bandwidth

Answer

Converting logs to a standard format