CNDA Firewall Technologies and IDS/IPS 1

Question 1

Which firewall type inspects the full context of a TCP session rather than individual packets?

Accepted Answer

Stateful inspection firewall

Answer

A stateful firewall tracks the state of active connections and uses this context to determine whether packets belong to a legitimate session.

Question 2

What distinguishes a next-generation firewall (NGFW) from a traditional stateful firewall?

Accepted Answer

NGFW adds application-layer inspection, user identity awareness, and integrated IPS

Answer

An NGFW combines stateful inspection with deep packet inspection, application identification, user-based policies, and IPS capabilities.

Question 3

An IDS detects a known attack signature. What is the IMMEDIATE response it takes by default?

Accepted Answer

Sends an alert to the administrator

Answer

An IDS (Intrusion Detection System) is a passive device that generates alerts; it does not block traffic by default.

Question 4

Which IDS/IPS detection method identifies attacks by comparing traffic to known bad patterns?

Accepted Answer

Signature-based detection

Answer

Signature-based detection matches traffic against a database of known attack patterns, making it effective against known threats.

Question 5

A firewall rule set should follow which ordering principle for efficiency and security?

Accepted Answer

Most specific rules first, with a deny-all at the bottom

Answer

Specific rules should precede general ones, and an implicit or explicit deny-all at the end ensures no unauthorized traffic passes.

CNDA - Certified Network Defense Architect Practice Test