Firewalls and Intrusion Detection CSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the main difference between an Intrusion Prevention System (IPS) and an Intrusion Detection System (IDS)?

   • AIDS uses signatures, while IPS uses only machine learning
   • BIPS is only for cloud, while IDS is only for on-premises
   • CIPS actively blocks threats, while IDS only alerts
   • DIDS is more expensive than IPS
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is designing a cloud network for a multi-tier application. They want to place a firewall at the boundary between the internet and their VPC to filter inbound traffic before it reaches the application servers. They also need to maintain state for legitimate return traffic. Which firewall type and placement should they use?

   • AA host-based firewall installed on each application server.
   • BA stateful firewall deployed at the VPC edge or in a DMZ subnet.
   • CA web application firewall (WAF) placed in front of the load balancer.
   • DA stateless network ACL attached to each application subnet.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is an advantage of using a managed IDS/IPS service in the cloud?

   • AIt always provides better detection than self-managed solutions
   • BThe provider handles the underlying infrastructure and updates
   • CIt eliminates the need for firewall rules
   • DIt guarantees zero false positives
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's cloud environment has a legacy application that cannot be patched, and the security team has identified a known exploit that targets a specific vulnerability in that application. The team wants to block the exploit traffic in real time without taking the application offline. Which control should they deploy?

   • AConfigure a stateful firewall to deny all inbound traffic to the application's port.
   • BEnable a network-based intrusion detection system (IDS) in monitor mode to alert on the exploit.
   • CAdd a network ACL rule to allow only traffic from known good IP addresses.
   • DDeploy an intrusion prevention system (IPS) with a signature for the known exploit and place it inline in the traffic path.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is reviewing cloud network traffic logs and notices repeated failed SSH login attempts from a single external IP address to multiple instances in the same subnet. The analyst wants to detect this pattern automatically and generate an alert for the incident response team. Which solution should they implement?

   • ADeploy a host-based intrusion prevention system (HIPS) on each instance to block the source IP.
   • BEnable VPC flow logs and manually review them daily.
   • CAdd a network ACL rule to deny all traffic from the external IP address.
   • DConfigure a network-based intrusion detection system (IDS) to monitor traffic and trigger alerts on brute-force patterns.
   Reveal Solution Discussion Select an answer first