Intrusion Detection and Prevention Systems (IDS/IPS) NDE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An attacker is using a combination of packet fragmentation and TCP segmentation to evade a network-based IDS. The IDS is deployed inline and has stream reassembly enabled. However, the attacker is also using a technique that causes the IDS and the target server to reassemble packets differently. What is the most effective countermeasure?

   • AIncrease the IDS's buffer size to capture more packets
   • BConfigure the IDS to match the target server's reassembly policy
   • CSwitch the IDS to passive mode to reduce false positives
   • DDisable stream reassembly to avoid the discrepancy
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security administrator is tuning an inline IPS that has been generating a high volume of alerts for legitimate peer-to-peer backup traffic. The IPS is currently configured to reset connections for any traffic matching a broad signature. The administrator wants to reduce false positives while still blocking the actual malware that uses similar traffic patterns. What is the most appropriate action?

   • AChange the IPS action from reset to alert-only for the broad signature
   • BCreate an allowlist for the backup servers' IP addresses and keep the reset action for all other traffic
   • CIncrease the IPS sensitivity so it flags more traffic as malicious
   • DDisable the IPS and rely on the firewall for all blocking
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst is comparing two IDS solutions for a network that experiences frequent legitimate protocol variations. Solution A uses signature-based detection and has a low false-positive rate. Solution B uses anomaly-based detection and has a high false-positive rate but can detect zero-day attacks. The team wants to minimize false positives while still detecting unknown threats. Which approach is most effective?

   • AUse Solution A and disable anomaly detection entirely.
   • BDeploy both solutions and correlate alerts.
   • CUse Solution B only.
   • DUse Solution A only.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of an intrusion detection system (IDS) in network security?

   • ATo replace the firewall as the primary network defense
   • BTo automatically block malicious traffic in real time
   • CTo encrypt all data transmitted across the network
   • DTo monitor network traffic and alert administrators to suspicious activity
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is troubleshooting why their network IDS is not detecting a known exploit. The exploit uses a technique where the attacker sends the payload in small, out-of-order TCP segments. The IDS is configured with signature-based detection and is placed passively on a SPAN port. Which configuration change is most likely to enable detection?

   • ASwitch to anomaly-based detection.
   • BMove the IDS to an inline position.
   • CEnable TCP stream reassembly and protocol decoding.
   • DIncrease the SPAN port bandwidth.
   Reveal Solution Discussion Select an answer first