NIDS/NIPS/NGFW GMON Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which log type from an NGFW is most useful for correlating a security incident with a specific user account?

   • ASystem logs that record device reboots
   • BSNMP trap logs
   • CConfiguration change logs
   • DTraffic logs that include user identification information
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An attacker is sending fragmented packets that evade a NIDS's signature detection. The NIDS is deployed passively on a SPAN port. Which countermeasure is most effective to mitigate this evasion technique?

   • ADisable the signatures that are evaded by fragmentation.
   • BDeploy the NIDS inline to block fragmented packets.
   • CIncrease the NIDS's logging verbosity to capture more details.
   • DEnable IP defragmentation and stream reassembly on the NIDS.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company wants to enforce a policy that allows employees to use web-based email but blocks uploading attachments to personal cloud storage. The NGFW is currently configured with port-based rules. What is the most effective configuration to achieve this?

   • ABlock all HTTPS traffic to force users to use only approved applications.
   • BUse user identification to block specific users from using cloud storage.
   • CEnable application identification and create rules that allow webmail but block the specific cloud-storage applications.
   • DEnable SSL decryption and inspect all HTTPS traffic for keywords.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A financial firm wants to monitor its internal network for lateral movement without risking disruption to time-sensitive trading applications. Which deployment mode is most appropriate?

   • AInline NGFW with strict application control and user identification.
   • BInline NIPS with automatic blocking of any suspicious traffic.
   • CPassive NIDS with no alerting, only logging for later analysis.
   • DPassive NIDS on a SPAN port to detect anomalies and alert on suspicious activity.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which detection method is most effective at identifying previously unknown threats that do not match any existing signature?

   • APort-based access control
   • BStateful packet filtering
   • CSignature-based detection
   • DAnomaly-based detection
   Reveal Solution Discussion Select an answer first