Technical Controls (firewalls, IDS/IPS, VPNs, SIEM) ECSS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Where is an IPS typically placed to maximize its effectiveness in protecting an internal network?

   • AOut-of-band on a SPAN port of the core switch
   • BIn the DMZ, but not connected to the internal network
   • CInline at the network perimeter, between the firewall and the internal network
   • DOn the internal network, but only monitoring server traffic
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the key difference between an Intrusion Prevention System (IPS) and an Intrusion Detection System (IDS)?

   • AAn IPS uses signature-based detection, while an IDS uses anomaly-based detection
   • BAn IPS only monitors host activity, while an IDS only monitors network traffic
   • CAn IPS can actively block or drop malicious traffic, while an IDS only alerts
   • DAn IPS is deployed out-of-band, while an IDS is inline
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst notices that an IDS generates a high volume of alerts for legitimate traffic that deviates slightly from normal patterns, such as a user accessing a rarely used application. The IDS is configured to compare current traffic against a baseline of normal network behavior. Which detection method is causing these alerts?

   • AStateful protocol analysis
   • BBehavior-based detection
   • CAnomaly-based detection
   • DSignature-based detection
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A SOC team is overwhelmed by the volume of SIEM alerts, many of which are low-priority or false positives. They want to prioritize alerts so that critical incidents are addressed first, while still retaining the ability to investigate lower-priority events later. Which SIEM capability should they implement?

   • ADisable all low-priority correlation rules.
   • BIncrease log retention to store more data.
   • CImplement alert scoring and risk-based prioritization.
   • DRoute all alerts to a single email inbox.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company needs to provide secure remote access for employees who use a mix of managed laptops and personal devices. The security team wants to enforce strong authentication and ensure that only authorized devices can connect. They also want to minimize the need to deploy and maintain client software on personal devices. Which VPN solution best meets these conflicting requirements?

   • ASite-to-site IPsec VPN from each employee's home router.
   • BL2TP over IPsec with pre-shared keys.
   • CIPsec remote-access VPN with certificates on managed laptops only.
   • DSSL/TLS VPN with client certificate authentication and browser-based access.
   Reveal Solution Discussion Select an answer first