CSS Security Products & Solutions Knowledge 2 — Questions and Answers
Question 1: Which type of intrusion detection system (IDS) analyzes network traffic patterns to identify anomalies rather than matching known attack signatures?
- Signature-based IDS
- Anomaly-based IDS (Correct answer)
- Host-based IDS
- Protocol-based IDS
Correct answer: Anomaly-based IDS
Anomaly-based IDS establishes a baseline of normal behavior and flags deviations, making it effective against zero-day attacks.
Question 2: A customer wants to consolidate firewall, VPN, and intrusion prevention into a single appliance. Which product category best fits their need?
- Next-Generation Firewall (NGFW)
- Unified Threat Management (UTM) (Correct answer)
- Security Information and Event Management (SIEM)
- Data Loss Prevention (DLP)
Correct answer: Unified Threat Management (UTM)
UTM appliances combine multiple security functions—firewall, VPN, IPS, antivirus, and more—into one device, ideal for SMBs seeking simplified management.
Question 3: Which access control model grants permissions based on a user's organizational role rather than individual identity?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC assigns permissions to roles (e.g., 'manager,' 'employee'), and users inherit those permissions when assigned to a role.
Question 4: What is the primary purpose of a Web Application Firewall (WAF)?
- Encrypting data in transit between servers
- Protecting web applications from attacks like SQL injection and XSS (Correct answer)
- Monitoring employee internet usage and content
- Filtering spam and phishing emails before delivery
Correct answer: Protecting web applications from attacks like SQL injection and XSS
A WAF inspects HTTP/HTTPS traffic and blocks application-layer attacks targeting web applications, such as SQL injection and cross-site scripting.
Question 5: A healthcare organization needs to prevent patient records from being emailed outside the network. Which security solution addresses this requirement?
- Endpoint Detection and Response (EDR)
- Data Loss Prevention (DLP) (Correct answer)
- Security Orchestration and Automated Response (SOAR)
- Network Access Control (NAC)
Correct answer: Data Loss Prevention (DLP)
DLP solutions monitor and control data transfers, preventing sensitive information like PHI from leaving the organization via email or other channels.
Question 6: Which biometric authentication method is considered the most difficult to spoof due to its uniqueness and the number of data points captured?
- Fingerprint scanning
- Voice recognition
- Iris scanning (Correct answer)
- Facial recognition
Correct answer: Iris scanning
Iris scanning captures over 200 unique data points and is extremely difficult to replicate, making it one of the most secure biometric methods.
Question 7: What distinguishes an Endpoint Detection and Response (EDR) solution from traditional antivirus software?
- EDR only scans files on demand, while antivirus runs continuously
- EDR provides continuous monitoring and behavioral analysis with incident response capabilities (Correct answer)
- EDR is only deployed on servers, while antivirus protects workstations
- EDR blocks all USB devices, while antivirus focuses on malware signatures
Correct answer: EDR provides continuous monitoring and behavioral analysis with incident response capabilities
EDR continuously records endpoint activity, uses behavioral analytics to detect threats, and provides tools for investigation and response beyond simple signature-based blocking.
CSS Security Products & Solutions Knowledge 2
Which type of intrusion detection system (IDS) analyzes network traffic patterns to identify anomalies rather than matching known attack signatures?