Firewalls and Intrusion Detection CSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does an Intrusion Prevention System (IPS) typically integrate with a firewall in a cloud network?

   • AThe IPS is used only for cloud storage security
   • BThe IPS replaces the firewall entirely
   • CThe IPS only monitors firewall logs and does not affect traffic
   • DThe IPS is placed after the firewall to inspect and block malicious traffic that passes through
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company runs a three-tier web application in a cloud VPC. The web tier must accept HTTPS from the internet, the app tier must accept traffic only from the web tier, and the database tier must accept traffic only from the app tier on port 3306. The security team wants to enforce these rules at the subnet level so that any instance placed in a subnet automatically inherits the correct restrictions. Which approach should they use?

   • AUse a web application firewall in front of the load balancer to filter traffic to all tiers.
   • BConfigure security groups on each instance and attach them to the instance's elastic network interface.
   • CAttach a network ACL to each subnet with allow rules for the required source and destination ports.
   • DDeploy a stateful firewall appliance in each subnet and route all traffic through it.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company wants to protect its cloud workload from known exploit attempts. They need a solution that can actively block malicious traffic in real time and also provide visibility into application-layer traffic. Which solution should they choose?

   • AA host-based firewall that only allows whitelisted applications.
   • BA cloud security group with deny rules for known malicious IPs.
   • CA network-based intrusion detection system (IDS) that generates alerts.
   • DAn intrusion prevention system (IPS) integrated with a next-generation firewall (NGFW).
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A financial services company must meet a regulatory requirement to inspect all traffic entering and leaving its cloud environment, including traffic between VPCs. The company has a security team that is experienced with managing virtual appliances but wants to minimize the number of separate tools. They also need to retain logs for at least one year for compliance audits. Which solution best meets these requirements?

   • ADeploy a managed IDS service in each VPC and send alerts to a central console.
   • BUse separate network ACLs and security groups for each VPC and rely on flow logs for auditing.
   • CDeploy a centralized virtual NGFW/IPS appliance in a hub VPC and route all inter-VPC and egress traffic through it, with logs forwarded to a SIEM.
   • DEnable VPC peering and rely on each VPC's default security groups for protection.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has a VPC with multiple subnets. They want to implement a security policy that blocks all traffic from a specific IP range at the subnet level, while allowing all other traffic. They also want to ensure that the policy is applied consistently across all subnets. Which approach should they use?

   • ACreate a security group and attach it to all instances in the VPC.
   • BCreate a network ACL for each subnet with a deny rule for the IP range and an allow-all rule for the rest.
   • CModify the route tables to drop traffic from the IP range.
   • DUse a central NGFW to filter traffic based on IP ranges.
   Reveal Solution Discussion Select an answer first