NIDS/NIPS/NGFW GMON Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team is evaluating a NIDS that uses behavioral detection. The NIDS has been running for a week and has generated several alerts for unusual outbound traffic patterns. The team wants to determine if these alerts indicate a real compromise or just normal variation in network usage. Which approach is most effective?

   • ACompare the alerts against a baseline of normal network behavior established over a longer period.
   • BImmediately block all outbound traffic to the destinations in the alerts.
   • CDisable behavioral detection and rely only on signature-based detection.
   • DIncrease the alert threshold to reduce the number of alerts.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security analyst is reviewing a NIDS alert that fired on a signature for a known remote code execution exploit. The alert shows a source IP from a partner network and a destination IP of an internal web server. The web server logs show no successful exploitation, but the alert repeats every few minutes. The analyst suspects the signature is matching a benign pattern in the application's traffic. Which action is most appropriate to confirm the suspicion?

   • ADisable the signature to stop the repeated alerts.
   • BIncrease the alert threshold so the alert only fires after multiple occurrences.
   • CBlock the partner IP address at the firewall to stop the alerts.
   • DExtract the relevant packet capture from the NIDS and compare it with the signature's trigger conditions.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A manufacturing company must inspect all traffic between its OT network and the corporate IT network. The security team needs to block known malicious signatures immediately, but also wants to allow legitimate industrial protocols that are not yet fully documented. Which deployment approach best meets these requirements?

   • ADeploy an NGFW in inline mode with signature-based IPS enabled and application-aware rules that permit known OT protocols.
   • BDeploy a traditional stateful firewall with port-based rules and no IPS features.
   • CDeploy an inline NIPS with only behavioral analysis and no signature rules to avoid blocking undocumented OT protocols.
   • DDeploy a passive NIDS with anomaly detection and alert only on traffic that deviates from baseline behavior.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security architect is deciding where to place a network security device to monitor traffic between two internal network segments. The device must be able to block malicious traffic in real time, but the network team is concerned about adding latency to a latency-sensitive application. Which deployment mode and device type is most appropriate?

   • ADeploy a NIPS inline with optimized rule sets and hardware acceleration.
   • BDeploy a NIDS passively on a SPAN port to avoid latency.
   • CDeploy a NGFW in passive mode to inspect traffic without adding latency.
   • DDeploy a NIDS inline with fail-open to minimize latency.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A NIDS alert shows a high-severity signature match for a known exploit against a web server. The analyst checks the server logs and finds no successful exploitation, but the alert repeats every few minutes. Which initial step is most appropriate to determine if this is a true positive or a false positive?

   • ACompare the full packet capture or session data with the signature's trigger conditions.
   • BImmediately block the source IP address in the firewall.
   • CDisable the signature to stop the repeated alerts.
   • DIncrease the alert threshold so the alert only fires after multiple occurrences.
   Reveal Solution Discussion Select an answer first