CNDA Firewall Technologies and IDS/IPS

Question 1

Which firewall type inspects the full context of a TCP session rather than individual packets?

Accepted Answer

Stateful inspection firewall

Answer

Packet filter firewall

Answer

Proxy firewall

Answer

Next-generation firewall

Question 2

What distinguishes a next-generation firewall (NGFW) from a traditional stateful firewall?

Accepted Answer

NGFW adds application-layer inspection, user identity awareness, and integrated IPS

Answer

NGFW only filters at Layer 3

Answer

NGFW cannot perform NAT

Answer

NGFW uses only signature-based detection

Question 3

An IDS detects a known attack signature. What is the IMMEDIATE response it takes by default?

Accepted Answer

Sends an alert to the administrator

Answer

Blocks the connection automatically

Answer

Resets the attacker's TCP session

Answer

Quarantines the source IP

Question 4

Which IDS/IPS detection method identifies attacks by comparing traffic to known bad patterns?

Accepted Answer

Signature-based detection

Answer

Anomaly-based detection

Answer

Heuristic detection

Answer

Behavioral analysis

Question 5

A firewall rule set should follow which ordering principle for efficiency and security?

Accepted Answer

Most specific rules first, with a deny-all at the bottom

Answer

Most permissive rules first

Answer

Rules in alphabetical order

Answer

Deny-all at the top, allow rules at the bottom

Question 6

What is the primary risk of placing an IDS sensor outside the perimeter firewall?

Accepted Answer

It generates excessive false positives from internet noise but misses post-filter attacks

Answer

It will only see encrypted traffic

Answer

It cannot detect internal threats

Answer

It requires more storage