A security analyst is evaluating an IDS for a network that frequently changes, with new applications and services added monthly. The analyst wants to detect zero-day attacks but is concerned about the administrative overhead of maintaining detection rules. Which detection method is most appropriate?

Policy-based detection that only allows traffic matching explicit allow rules

A hybrid approach using only signature-based detection for known threats

Signature-based detection with a regularly updated rule set

Anomaly-based detection that learns the normal traffic baseline

After deploying an IPS, the security team notices that legitimate traffic is being blocked because the IPS flags normal application behavior as malicious. Which tuning action should be taken first?

Increase the logging level to capture more data.

Switch to a different detection method.

Adjust the sensitivity threshold for the affected signatures.

What is a false positive in the context of IDS/IPS?

A malicious activity that goes undetected

A system error that causes the IDS to crash

An alert generated for legitimate activity that is incorrectly flagged as malicious

A correct detection of a real attack

An attacker is using SSL/TLS encryption to hide malicious payloads from the network IDS. The security team wants to inspect the decrypted traffic. What is the most effective approach?

Deploy a TLS interception proxy that decrypts, inspects, and re-encrypts traffic.

Configure the IDS to ignore encrypted traffic.

Use a host-based IDS that only monitors file integrity.

Increase the IDS signature set for encrypted traffic.

EC-CouncilNetwork Defense Essentials

Domain 3Objective 3

Intrusion Detection and Prevention Systems (IDS/IPS) NDE Practice Questions (Page 5)

Part of the Technical Security Controls domain, which makes up ~16% of our current practice bank.

40questions here

8free pages

7concepts

Questions 21–25

21application · medium
A security analyst is evaluating an IDS for a network that frequently changes, with new applications and services added monthly. The analyst wants to detect zero-day attacks but is concerned about the administrative overhead of maintaining detection rules. Which detection method is most appropriate?
Select an answer first
22foundation · easy
Which detection method is most effective at identifying previously unknown attacks that deviate from normal behavior?
Select an answer first
23application · medium
After deploying an IPS, the security team notices that legitimate traffic is being blocked because the IPS flags normal application behavior as malicious. Which tuning action should be taken first?
Select an answer first
24foundation · easy
What is a false positive in the context of IDS/IPS?
Select an answer first
25application · medium
An attacker is using SSL/TLS encryption to hide malicious payloads from the network IDS. The security team wants to inspect the decrypted traffic. What is the most effective approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.

Intrusion Detection and Prevention Systems (IDS/IPS) NDE Practice Questions (Page 5)

Questions 21–25

Which detection method is most effective at identifying previously unknown attacks that deviate from normal behavior?

After deploying an IPS, the security team notices that legitimate traffic is being blocked because the IPS flags normal application behavior as malicious. Which tuning action should be taken first?

What is a false positive in the context of IDS/IPS?

An attacker is using SSL/TLS encryption to hide malicious payloads from the network IDS. The security team wants to inspect the decrypted traffic. What is the most effective approach?

Keep studying — Technical Security Controls