Firewalls and Intrusion Detection CSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company runs a three-tier web application in a cloud VPC. The web tier must accept HTTPS from the internet, the application tier must only accept traffic from the web tier, and the database tier must only accept traffic from the application tier on port 3306. The security team wants to enforce these rules with a stateful, default-deny posture while minimizing administrative overhead. Which approach should they use?

   • AAttach a security group to each tier's instances, allowing only the required inbound traffic and relying on the stateful return-traffic behavior.
   • BPlace a stateful network ACL on each subnet and allow only the required ports, since network ACLs automatically track connection state.
   • CUse a single security group for all tiers and restrict traffic by IP addresses of the web tier instances.
   • DCreate a network ACL for each subnet with explicit allow rules for the required traffic and a deny-all rule at the end.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security operations center (SOC) receives an alert from a network IDS indicating a possible brute-force attack against a cloud VM's SSH port. The SOC analyst needs to determine if the attack succeeded and what to do next. Which action should the analyst take first?

   • AIgnore the alert because IDS alerts are often false positives.
   • BImmediately terminate the VM to stop the attack.
   • CCheck the VM's authentication logs for successful logins from the attacking IP.
   • DAdd a firewall rule to block the attacking IP.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   During a security incident, a cloud IDS alerts on a compromised VM that is sending large amounts of data to an external IP. The incident response team needs to contain the threat while preserving evidence for forensic analysis. The VM is running a critical application that cannot be stopped. Which containment action should they take first?

   • AApply a network ACL or security group rule to block outbound traffic from the VM to the external IP, while allowing other traffic.
   • BShut down the VM immediately to stop the data exfiltration.
   • CTake a snapshot of the VM's disk before taking any action.
   • DDisconnect the VM's network interface from the VPC.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security architect is designing monitoring for a cloud environment that includes both containerized microservices and traditional VMs. The team needs to detect both network-level attacks (e.g., port scans) and host-level attacks (e.g., privilege escalation inside a container). They have a limited budget and want to minimize the number of tools. Which combination should they choose?

   • AUse cloud provider's flow logs and a separate log analysis tool for both network and host monitoring.
   • BDeploy only a host-based IDS on each VM and container host.
   • CDeploy a network-based IDS for the VPC and a host-based IDS agent on each VM and container host.
   • DDeploy only a network-based IDS to monitor all traffic.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How can firewall and IDS alerts support incident response?

   • AThey provide evidence of the attack vector and timeline
   • BThey automatically contain the incident without human intervention
   • CThey replace the need for forensic analysis
   • DThey only provide information about false positives
   Reveal Solution Discussion Select an answer first