Firewalls and Intrusion Detection CSE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company hosts a customer-facing web application on a cloud load balancer. The application has suffered from SQL injection and cross-site scripting (XSS) attacks. The security team wants to block these attacks at the edge without modifying application code. Which solution should they implement?

   • AEnable VPC flow logs and analyze them for malicious patterns.
   • BUse a network ACL to deny traffic from the attackers' IP addresses.
   • CDeploy a web application firewall (WAF) in front of the load balancer with managed rules for SQL injection and XSS.
   • DConfigure a stateful network firewall to block ports 80 and 443.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   In which cloud scenario is a stateless firewall most appropriate?

   • AWhen simple, high-throughput filtering based on IP/port is needed and connection tracking is not required
   • BWhen filtering traffic based on connection state to allow return traffic automatically
   • CWhen you need to block traffic from specific geographies
   • DWhen deep packet inspection for application-layer threats is required
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   After deploying a cloud firewall and an IDS, a security analyst wants to correlate firewall deny logs with IDS alerts to identify a potential attack campaign. The analyst needs a centralized view of both data sources and the ability to search across them quickly. Which approach should they take?

   • AReview firewall logs and IDS alerts separately in their respective consoles.
   • BConfigure the IDS to send alerts directly to the firewall for automatic blocking.
   • CEnable flow logs and store them in object storage for later analysis.
   • DForward firewall and IDS logs to a centralized logging and SIEM platform for correlation and search.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company is migrating its on-premises data center to the cloud and wants to replace its legacy firewall with a solution that can identify applications by their signatures (e.g., Facebook, Skype) and block malicious traffic based on threat intelligence feeds. The solution must also integrate with Active Directory for user-based policies. Which type of firewall should they choose?

   • AA network ACL with deny rules for known malicious IP addresses.
   • BA stateful firewall with allow rules for known ports and protocols.
   • CA web application firewall (WAF) with managed rules for OWASP Top 10.
   • DA next-generation firewall (NGFW) with application identification, IPS, and user identity integration.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company is designing a cloud network for a multi-tier application. They want to place a firewall that can inspect traffic between application tiers and also provide intrusion prevention. The firewall must be able to scale with traffic and be managed centrally. Which placement and type of firewall should they choose?

   • AA next-generation firewall (NGFW) virtual appliance deployed in a central inspection VPC with traffic routed through it.
   • BA security group attached to each tier's instances.
   • CA network ACL on each subnet.
   • DA web application firewall (WAF) placed in front of each tier.
   Reveal Solution Discussion Select an answer first