Technical Controls (firewalls, IDS/IPS, VPNs, SIEM) ECSS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team wants to monitor traffic between the internal network and the DMZ to detect attacks that originate from compromised internal hosts. They also want to avoid introducing a point of failure that could disrupt traffic if the monitoring device fails. Which deployment approach best meets these requirements?

   • ADeploy an IDS inline between the internal network and the DMZ.
   • BDeploy an IPS in tap mode between the internal network and the DMZ.
   • CDeploy an IPS inline between the internal network and the DMZ.
   • DDeploy an IDS on a SPAN port between the internal network and the DMZ.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does an IDS typically monitor network traffic?

   • ABy placing itself inline and blocking malicious packets
   • BBy analyzing copies of traffic through a network tap or span port
   • CBy modifying firewall rules to deny malicious sources
   • DBy acting as a proxy for all network connections
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a remote-access VPN architecture, what does the client software typically do?

   • AIt establishes an encrypted tunnel to the VPN gateway
   • BIt blocks all inbound traffic to the user's device
   • CIt provides a backup of the user's files
   • DIt scans the user's device for malware
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In the context of VPNs, what does 'tunneling' refer to?

   • AEncapsulating data packets within another protocol for secure transmission
   • BBlocking unauthorized access to the network
   • CCompressing data to reduce bandwidth usage
   • DRouting traffic through multiple proxies to hide the source
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is a key characteristic of a stateful inspection firewall compared to a packet filtering firewall?

   • AIt only examines individual packets in isolation
   • BIt requires a proxy server for every protocol
   • CIt tracks the state of active connections
   • DIt operates exclusively at the application layer
   Reveal Solution Discussion Select an answer first