2.1 Describe Network Security Solutions and Deployment Models That Provide Intrusion Prevention and Firewall Capabilities 350-701 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company's security operations center (SOC) uses a SIEM platform to correlate events from multiple sources. They want to automatically receive alerts from their NGFW and IPS when suspicious traffic is detected, so analysts can respond quickly. Which integration should they configure?

   • ASNMP traps only
   • BSyslog forwarding from NGFW and IPS to the SIEM
   • CDirect database connection from SIEM to firewall logs
   • DEmail alerts from NGFW and IPS to the SOC
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A regional bank is deploying a new IPS to inspect traffic between its internal network and the internet. The bank requires that if the IPS fails, traffic must continue to flow without interruption, and the security team wants to minimize the chance of the IPS becoming a bottleneck during peak hours. Which deployment mode should the bank choose?

   • AInline with fail-open mode
   • BInline with fail-closed mode
   • CCloud-based IPS with API integration
   • DPassive (SPAN port) mode
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A large e-commerce company is designing a high-availability firewall deployment for its data center. The firewall must support active-active clustering to maximize throughput, and the security team wants to ensure that if one firewall fails, existing connections are not dropped. Which configuration should they implement?

   • ALoad balancer in front of two standalone firewalls
   • BActive-active clustering with stateful failover
   • CActive-passive clustering with stateful failover
   • DActive-active clustering without stateful failover
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the purpose of integrating threat intelligence feeds into an IPS?

   • ATo update the IPS with indicators of compromise (IOCs) such as malicious IP addresses and domains.
   • BTo replace the need for signature-based detection entirely.
   • CTo provide a backup of the IPS configuration to a cloud service.
   • DTo allow the IPS to communicate with other IPS devices in a mesh topology.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a primary advantage of a passive (out-of-band) deployment for an intrusion detection system?

   • AIt can actively block malicious traffic in real time.
   • BIt provides better visibility into encrypted traffic.
   • CIt requires less configuration than an inline deployment.
   • DIt does not introduce latency or become a single point of failure for the traffic path.
   Reveal Solution Discussion Select an answer first