Intrusion Detection and Prevention Systems (IDS/IPS) NDE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which response action is commonly taken by an IPS to terminate an active malicious session?

   • AResetting the TCP connection
   • BChanging the user's password
   • CEncrypting the traffic
   • DLogging the event only
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   A security analyst needs to monitor the activities of a single critical server, including file integrity and process behavior. Which type of IDS/IPS is most appropriate?

   • ANetwork-based IDS/IPS (NIDS/NIPS)
   • BHost-based IDS/IPS (HIDS/HIPS)
   • CWireless IDS/IPS (WIDS/WIPS)
   • DPerimeter IDS/IPS
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An IPS has been detecting a high number of false positives for a legitimate application that uses unusual network behavior. The security team wants to maintain protection against real attacks but reduce the noise. Which action is the most appropriate first step?

   • AIncrease the IPS sensitivity to catch more real attacks
   • BDisable the IPS entirely until the application is updated
   • CCreate a custom signature that excludes the legitimate application's traffic
   • DSwitch the IPS to alert-only mode and review alerts weekly
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company wants to monitor all traffic entering and leaving its corporate network. The security team needs to see both inbound and outbound traffic, but the existing firewall is already a bottleneck. Which IDS/IPS placement provides visibility without adding inline latency?

   • AInline IPS immediately behind the firewall.
   • BWireless IDS placed near the WAN router.
   • CPassive IDS connected to a network TAP on the WAN link.
   • DHost-based IDS on the firewall itself.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which statement best describes the role of an intrusion prevention system (IPS) in network security?

   • AIt actively blocks or drops malicious traffic while alerting administrators
   • BIt replaces the need for all other security controls
   • CIt passively monitors and reports on suspicious activity
   • DIt only logs network traffic for forensic analysis
   Reveal Solution Discussion Select an answer first