Intrusion Detection and Prevention Systems (IDS/IPS) NDE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An attacker is attempting to evade a network-based IDS by sending a malicious payload split across many small packets that the IDS does not reassemble. The IDS is deployed passively on a SPAN port. Which countermeasure would be most effective against this fragmentation-based evasion?

   • AIncrease the IDS signature sensitivity to catch more fragments
   • BEnable stream reassembly on the IDS so it can reconstruct fragmented flows before inspection
   • CDeploy a second IDS on the same SPAN port to double coverage
   • DSwitch the IDS to inline mode and enable deep packet inspection
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary difference between an alert and a block action in an IPS?

   • AAn alert only notifies administrators, while a block prevents the traffic from reaching its destination
   • BAn alert is used for known attacks, while a block is used for unknown attacks
   • CAn alert is passive, while a block is also passive but more detailed
   • DAn alert is automated, while a block requires manual intervention
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An attacker is evading a network-based IDS by encoding the payload in a way that the IDS does not decode, while the target server does. Which countermeasure is most effective?

   • AUse a signature that matches the raw encoded payload
   • BIncrease the IDS buffer size to capture more packets
   • CEnable protocol decoding and normalization on the IDS
   • DDeploy the IDS in inline mode without any additional configuration
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security administrator is deploying an IPS in a data center with high-throughput links. The administrator is concerned about the IPS becoming a bottleneck. Which factor is most important to consider during the deployment?

   • AThe physical size of the IPS appliance
   • BThe color of the IPS management interface
   • CThe number of signatures in the IPS rule set
   • DThe IPS's rated throughput and the actual traffic volume
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An attacker is sending a known exploit payload but fragments it across multiple TCP segments to evade detection. The security team notices the IDS is not generating alerts for the attack. Which detection capability is most likely missing from the IDS configuration?

   • AProtocol decoding and TCP stream reassembly.
   • BAnomaly-based detection of packet size variations.
   • CHost-based file integrity monitoring.
   • DPolicy-based detection of non-standard port usage.
   Reveal Solution Discussion Select an answer first