Intrusion Detection and Prevention Systems (IDS/IPS) NDE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is configuring an IDS for a network that must comply with a policy that only allows specific applications to run. The team wants to detect any violation of this policy. Which detection method is most appropriate?

   • APolicy-based detection.
   • BAnomaly-based detection.
   • CStateful protocol analysis.
   • DSignature-based detection.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company wants to detect and block malicious traffic at the network perimeter. They also need to maintain a log of all detected threats for compliance. Which solution should they implement?

   • AA host-based firewall with logging enabled
   • BA network-based IDS in passive mode with logging enabled
   • CA wireless IDS with logging enabled
   • DA network-based IPS in inline mode with logging enabled
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which technique is commonly used by attackers to evade signature-based IDS by altering the payload to avoid matching known patterns?

   • APolymorphic malware
   • BEncryption
   • CFragmentation
   • DTiming attacks
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A hospital's security team needs to detect unauthorized devices connecting to the clinical Wi-Fi network and prevent them from communicating with medical devices. Which type of IDS/IPS is best suited for this requirement?

   • ANetwork-based IPS deployed inline at the network core.
   • BWireless IPS (WIPS) with rogue AP and client detection.
   • CSignature-based network IDS on the Wi-Fi controller.
   • DHost-based IDS installed on each medical device.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security administrator is tuning an anomaly-based IDS in a university network. The network has very predictable traffic during the semester but becomes almost idle during breaks. The administrator notices that the IDS generates many false positives at the start of each semester when students return. What is the best way to reduce these false positives?

   • ASwitch to signature-based detection to avoid baseline issues
   • BRetrain the baseline at the beginning of each semester and use a shorter learning period
   • CDisable the IDS during the first week of each semester
   • DUse a static baseline that was created during the semester
   Reveal Solution Discussion Select an answer first