Firewalls and Intrusion Detection CSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In a cloud environment, what is the primary role of a firewall?

   • ATo encrypt all data stored in cloud storage
   • BTo detect and block malware on individual endpoints
   • CTo filter network traffic based on predefined security rules
   • DTo manage user identities and access permissions
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team is investigating a potential compromise of a single cloud VM. They need to determine whether an attacker executed malicious commands locally on the VM and whether any unauthorized processes were started. Which type of monitoring should they use to collect this evidence?

   • AHost-based intrusion detection (HIDS) that monitors system logs, file integrity, and process activity.
   • BNetwork-based intrusion detection (NIDS) that analyzes traffic to and from the VM.
   • CCloud provider's flow logs for the VM's network interface.
   • DA web application firewall (WAF) log for the application hosted on the VM.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A retail company hosts a public-facing web application on cloud VMs behind a load balancer. The security team has noticed a spike in SQL injection attempts in the application logs, and the application team cannot patch the code immediately. Which control should be deployed to block these attacks at the edge without changing the application?

   • AEnable a web application firewall (WAF) with managed rules for SQL injection on the load balancer.
   • BAdd a network ACL rule to deny all traffic to the application's database port.
   • CDeploy a host-based intrusion prevention system (HIPS) on each web server and update its signatures.
   • DConfigure a stateful firewall rule to allow only GET requests to the application.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of a Web Application Firewall (WAF) in a cloud environment?

   • ATo protect web applications from common attacks such as SQL injection and cross-site scripting
   • BTo block all inbound traffic to the virtual network
   • CTo provide load balancing across multiple web servers
   • DTo encrypt data in transit between the client and the web server
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security team is investigating a potential compromise. They have a network IDS that generates alerts, but they need to correlate the alerts with other data sources to understand the full scope. They have access to VPC flow logs, DNS logs, and the VM's OS audit logs. Which combination of data sources would provide the most comprehensive view of the attack?

   • AOS audit logs only.
   • BVPC flow logs, DNS logs, and OS audit logs.
   • CVPC flow logs and DNS logs only.
   • DVPC flow logs and OS audit logs only.
   Reveal Solution Discussion Select an answer first