Firewalls and Intrusion Detection CSE Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   In addition to application awareness, what other key feature does a Next-Generation Firewall (NGFW) typically include?

   • AAntivirus scanning of all email attachments
   • BData loss prevention (DLP) for all data at rest
   • CIntrusion prevention system (IPS)
   • DLoad balancing and auto-scaling
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company is migrating its on-premises data center to a cloud VPC. They currently use a firewall that inspects traffic based on application identity, blocks known exploit signatures, and integrates with threat intelligence feeds. They want to replicate this capability in the cloud with a single device. Which solution best matches their requirement?

   • ADeploy a next-generation firewall (NGFW) virtual appliance from a cloud marketplace.
   • BUse a cloud provider's native security group with application-layer rules.
   • CConfigure a web application firewall (WAF) to inspect all traffic.
   • DEnable VPC flow logs and use a log analytics tool to detect threats.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is a common deployment model for IDS/IPS in a cloud environment?

   • AHost-based only, no network-based options
   • BVirtual appliance deployed in the VPC
   • COnly as a managed service, no self-managed options
   • DPhysical appliance installed in the cloud provider's data center
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A company has a cloud environment with multiple application tiers. The security team wants to enforce a 'default deny' policy at the subnet level while allowing specific traffic between tiers. They also want to ensure that any new subnet created automatically inherits this policy. Which approach should they take?

   • ACreate a custom network ACL with a default deny rule and associate it with all subnets.
   • BRely on the default network ACL, which allows all traffic, and add deny rules as needed.
   • CConfigure security groups on each instance with only allow rules for required traffic.
   • DDeploy a stateful firewall appliance and route all traffic through it.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A small company with a single cloud VPC wants to add intrusion prevention without managing additional virtual machines. They need a solution that automatically updates signatures and integrates with their existing cloud firewall rules. Which deployment model best meets their needs?

   • AEnable VPC flow logs and use a third-party log analyzer.
   • BUse a cloud provider's managed intrusion prevention service.
   • CDeploy a third-party IPS virtual appliance on a VM.
   • DConfigure a network ACL to block known malicious IPs.
   Reveal Solution Discussion Select an answer first