Firewalls and Intrusion Detection CSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst notices unusual outbound traffic from a cloud VM to a known command-and-control (C2) IP address. The company has a network-based IDS that generates alerts but does not block traffic. The analyst needs to confirm the alert and gather more context before taking action. Which step should the analyst take first?

   • AReview the IDS alert details and correlate with VPC flow logs and DNS logs.
   • BIgnore the alert because the IDS is passive and cannot block traffic.
   • CDisable the VM's network interface to stop all traffic.
   • DImmediately block the IP address in the security group.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a common type of firewall used in cloud environments?

   • APhysical firewall device
   • BVirtual firewall appliance
   • CHost-based firewall
   • DWeb application firewall
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which type of intrusion detection system is best suited to detect an attack that exploits a vulnerability in a web application running on a specific server?

   • AFirewall
   • BNetwork-based IDS
   • CCloud-based IDS
   • DHost-based IDS
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security analyst is investigating a potential breach. The IDS generated an alert for suspicious outbound traffic from a VM, but the firewall logs show that the traffic was allowed. The analyst needs to determine whether the alert was a true positive or a false positive. Which data source would be most useful to confirm the nature of the traffic?

   • AThe IDS alert itself, which includes the signature that triggered.
   • BFlow logs showing the source and destination IPs and ports.
   • CFirewall logs showing the rule that allowed the traffic.
   • DFull packet capture (PCAP) of the outbound traffic from the VM.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which feature is characteristic of a Next-Generation Firewall (NGFW) in a cloud environment?

   • ANo integration with threat intelligence
   • BLimited to IP address and port filtering
   • COnly stateless packet filtering
   • DApplication awareness and control
   Reveal Solution Discussion Select an answer first