CNDA Firewall Technologies and IDS/IPS 3

Question 1

What is the purpose of a 'stateful failover' configuration in a firewall cluster?

Accepted Answer

To replicate connection state tables so sessions survive a failover without dropping

Answer

Stateful failover synchronizes active session tables between firewall peers so existing connections continue seamlessly if the active unit fails.

Question 2

Which technique allows a host-based IDS (HIDS) to detect file system tampering?

Accepted Answer

File integrity monitoring (FIM) using cryptographic hashes

Answer

HIDS uses FIM to hash critical files at baseline and alerts when hashes change, indicating unauthorized modification.

Question 3

An attacker sends thousands of half-open TCP connections to overwhelm a server. Which firewall feature mitigates this?

Accepted Answer

SYN proxy or SYN cookies

Answer

A SYN proxy intercepts TCP handshakes and only forwards complete connections to the server, protecting against SYN flood attacks.

Question 4

What is the key advantage of anomaly-based IDS over signature-based IDS?

Accepted Answer

Ability to detect zero-day and previously unknown attacks

Answer

Anomaly-based IDS detects deviations from established baselines, enabling detection of novel attacks that have no known signatures.

Question 5

Which firewall policy approach explicitly denies all traffic that is not permitted by a specific rule?

Accepted Answer

Default deny (deny-all) policy

Answer

A default deny policy blocks all traffic unless explicitly allowed, implementing the principle of least privilege at the network level.

CNDA - Certified Network Defense Architect Practice Test