Firewalls and Intrusion Detection CSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the key difference between a stateful and a stateless firewall?

   • AStateful firewalls are always cloud-based, while stateless firewalls are on-premises
   • BStateless firewalls provide application-layer filtering, while stateful firewalls only filter IP addresses
   • CStateful firewalls track the state of active connections, while stateless firewalls evaluate each packet independently
   • DStateful firewalls are slower and less secure than stateless firewalls
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which tool is commonly used to centralize and analyze firewall and IDS logs in a cloud environment?

   • AConfiguration management database (CMDB)
   • BNetwork address translation (NAT) gateway
   • CLoad balancer
   • DSecurity Information and Event Management (SIEM) system
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security team is investigating a potential breach. They need to determine whether a specific VM communicated with an external IP address over the past 30 days. Which data source should they query first?

   • AThe VM's operating system audit logs.
   • BThe security group configuration history.
   • CThe cloud provider's billing records.
   • DVPC flow logs that capture all accepted and rejected traffic.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a common detection method used by an Intrusion Detection System (IDS)?

   • AEncryption-based detection
   • BLoad-balancing detection
   • CFirewall rule matching
   • DSignature-based detection
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is deploying a cloud-based IDS/IPS solution. They have a mix of workloads: some are in a VPC with a single subnet, and others are in a separate VPC connected via peering. They want to monitor all east-west traffic and block malicious activity. They are considering two options: a managed IDS/IPS service that can be enabled on VPCs, or a third-party IPS virtual appliance in a central VPC. Which factor should most influence their decision?

   • AThe managed service cannot block traffic, only detect it.
   • BThe virtual appliance requires no maintenance, while the managed service requires regular patching.
   • CThe virtual appliance will always be more expensive than the managed service.
   • DThe managed service may not support all VPC peering configurations, while a virtual appliance can inspect traffic from multiple VPCs if routed through it.
   Reveal Solution Discussion Select an answer first