NIDS/NIPS/NGFW GMON Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An organization wants to replace its legacy stateful firewall with a solution that can identify applications regardless of port, enforce policies based on user identity, and include intrusion prevention. Which technology is specifically designed to provide all these capabilities in a single device?

   • ANetwork intrusion prevention system (NIPS)
   • BWeb application firewall (WAF)
   • CNext-generation firewall (NGFW)
   • DNetwork intrusion detection system (NIDS)
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team is tuning a NIPS that sits inline before a critical database server. The NIPS is generating false positives that occasionally block legitimate database queries, causing application errors. The team wants to reduce false positives while still blocking known SQL injection attempts. The database traffic is encrypted with TLS, so the NIPS cannot inspect the payload. Which approach is most effective?

   • ACreate an allowlist for the database server's IP address to bypass inspection.
   • BConfigure the NIPS to decrypt TLS traffic using a trusted certificate and then apply SQL injection signatures.
   • CDisable the SQL injection signatures because the traffic is encrypted and cannot be inspected.
   • DSet the SQL injection signatures to alert-only mode to avoid blocking legitimate queries.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which countermeasure is most effective against evasion techniques that use packet fragmentation to bypass NIDS detection?

   • APerforming full packet reassembly before inspection
   • BIncreasing the signature update frequency
   • CBlocking all fragmented traffic
   • DDisabling fragment reassembly to save resources
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security engineer is configuring an inline NIPS for a high-throughput data center. The device is dropping packets under load, causing application timeouts. Which configuration change is most likely to improve performance while maintaining essential security?

   • AMove the NIPS to passive mode to eliminate inline latency.
   • BIncrease the number of signatures enabled to catch more threats.
   • CDisable all logging to reduce I/O overhead.
   • DEnable flow-based inspection instead of full packet inspection for less critical traffic.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An attacker is using a technique that sends overlapping IP fragments to evade a NIDS. The NIDS is deployed inline and is configured to drop packets that appear malformed. The attacker's fragments are crafted so that the NIDS reassembles them differently than the destination host. Which countermeasure is most effective to prevent this evasion?

   • AIncrease the fragment reassembly timeout to allow more time for reassembly.
   • BConfigure the NIDS to drop all overlapping fragments.
   • CDisable IP defragmentation on the NIDS to avoid reassembly errors.
   • DSwitch the NIDS to passive mode to avoid dropping legitimate traffic.
   Reveal Solution Discussion Select an answer first