Intrusion Detection and Prevention Systems (IDS/IPS) NDE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is designing a defense architecture for a new branch office. The branch has a single internet connection, a small server room, and about 50 employees. The security team wants to detect both network-level attacks and host-level threats, but the budget is limited. Which architecture provides the best coverage within the budget?

   • ADeploy a passive network IDS at the gateway and no host-based controls.
   • BDeploy a wireless IPS and a network IDS on the internal switch.
   • CDeploy host-based IPS on every employee workstation and no network monitoring.
   • DDeploy a network IPS inline at the internet gateway and host-based IDS on critical servers only.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has a mix of on-premises servers and remote employees who connect via VPN. The security team wants to detect and block malware that spreads between servers and also monitor the VPN traffic for intrusions. They have a limited budget and cannot deploy multiple full IPS appliances. Which solution is most effective?

   • ADeploy a host-based IPS only on remote employee laptops
   • BDeploy a single network-based IPS at the core switch to monitor all traffic
   • CDeploy a wireless IDS to cover the VPN and server traffic
   • DDeploy a network-based IPS at the internet perimeter and a host-based IPS on each server
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is tuning an IDS/IPS important in a production environment?

   • ATo increase the number of alerts generated
   • BTo reduce false positives and improve detection accuracy
   • CTo make the IDS operate in passive mode only
   • DTo disable all detection features
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which detection method relies on a database of known attack patterns or signatures?

   • APolicy-based detection
   • BHeuristic-based detection
   • CAnomaly-based detection
   • DSignature-based detection
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Where is a network-based IPS (NIPS) typically placed to inspect all incoming and outgoing traffic?

   • AOn a wireless access point only
   • BIn a passive tap on a network segment
   • COn the internal host's operating system
   • DInline at the network perimeter, such as between the firewall and the internal network
   Reveal Solution Discussion Select an answer first