Intrusion Detection and Prevention Systems (IDS/IPS) NDE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An IPS is deployed inline and has been blocking traffic that matches a signature for a known exploit. However, a legitimate business application also matches this signature, causing outages. The security team wants to maintain protection against the exploit but avoid the outages. Which action is most appropriate?

   • ADisable the signature entirely
   • BChange the IPS action to alert-only for that signature
   • CCreate an exception for the legitimate application's IP addresses and keep the blocking action for others
   • DIncrease the IPS sensitivity to catch more variants of the exploit
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A university campus network has a mix of wired and wireless users. The security team deployed a network IPS inline at the internet gateway and a wireless IPS for the Wi-Fi network. The team is seeing a high number of false positives from the network IPS, causing legitimate research traffic to be blocked. The wireless IPS is working well. Which action should the team take to reduce false positives without losing security?

   • AIncrease the sensitivity of the network IPS to catch more threats.
   • BPut the network IPS in alert mode and tune signatures based on observed alerts.
   • CDisable the network IPS and rely on the wireless IPS.
   • DReplace the network IPS with a passive IDS and add host-based IPS to all endpoints.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An inline IPS detects a connection that matches a known exploit signature. The security policy requires stopping the attack immediately while minimizing impact on other connections. Which response action should be configured?

   • AReset the specific TCP connection.
   • BSend an alert to the security team only.
   • CBlock all traffic from the source IP for 24 hours.
   • DShut down the switch port connected to the target server.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's security team needs to monitor traffic between two internal network segments for signs of lateral movement. They want to detect both known exploit attempts and unusual traffic patterns, but they cannot afford to introduce latency that would affect time-sensitive application traffic. Which deployment and detection combination best meets these requirements?

   • ADeploy an inline network IPS with signature-based detection on the segment boundary.
   • BInstall host-based IDS agents on every server in both segments.
   • CDeploy a network TAP with a passive IDS using both signature and anomaly detection.
   • DUse a wireless IDS to monitor the wired segment traffic.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which component of an IDS/IPS is responsible for collecting raw network traffic or host data for analysis?

   • ASensor or agent
   • BSignature database
   • CManagement console
   • DAnalysis engine
   Reveal Solution Discussion Select an answer first