Firewalls and Intrusion Detection CSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company runs a containerized application on a managed Kubernetes service. They need to detect malicious activity inside individual containers, such as unauthorized process execution or file system changes. They already have a network-based IDS monitoring east-west traffic. Which additional control should they implement?

   • AEnable VPC flow logs and send them to a SIEM.
   • BDeploy a host-based intrusion detection system (HIDS) agent on each node to monitor container activity.
   • CUse a web application firewall (WAF) in front of the Kubernetes API server.
   • DAdd a network ACL to block all traffic between containers.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary difference between host-based and network-based intrusion detection systems?

   • AHost-based is only for cloud, while network-based is only for on-premises
   • BHost-based monitors a single host's activity, while network-based monitors network traffic
   • CHost-based is less secure than network-based
   • DHost-based uses signatures, while network-based uses only anomaly detection
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   During incident response, what is the first step when a firewall or IDS alert is received?

   • AImmediately disconnect all affected systems from the network
   • BVerify the alert and assess its severity
   • CIgnore the alert if it is from a low-priority source
   • DDelete the alert logs to preserve system performance
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Why is logging important for firewall and IDS in a cloud environment?

   • ALogs automatically block malicious traffic
   • BLogs are only needed for performance tuning
   • CLogs provide a record of traffic and alerts for analysis and auditing
   • DLogs replace the need for monitoring tools
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   When implementing firewall rules in a cloud environment, what should be specified in each rule?

   • ASource IP, destination IP, port, and protocol
   • BOnly the destination IP address
   • CThe application name and user identity
   • DThe cloud provider's region and availability zone
   Reveal Solution Discussion Select an answer first