1.5 Identify and Describe Threat Prevention Systems and Practices (e.g., End User Awareness, Security Updates, Antivirus, Intrusion Prevention Systems, Firewalls) CYBERSECURITY-APPRENTICE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary function of an intrusion prevention system (IPS)?

   • ATo manage user authentication and access controls
   • BTo detect and block malicious network traffic in real time
   • CTo provide a backup of critical files
   • DTo encrypt all data transmitted over the network
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company's IT team discovered that a known vulnerability in a widely used application was exploited to gain access to a server. The vendor released a patch two weeks ago, but it was not applied. The server also runs antivirus software that is up to date. What is the most likely reason the antivirus did not prevent the attack?

   • AThe antivirus relies on signatures and may not detect exploits that target unpatched software vulnerabilities
   • BThe antivirus only protects against viruses, not other types of malware
   • CThe antivirus was configured to exclude the application's directory from scanning
   • DThe antivirus was not updated with the latest virus definitions
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's IT policy requires that all servers receive security patches within 30 days of release. A critical vulnerability is disclosed for a web server application, and the vendor releases a patch. The company's change management process takes 45 days to approve and deploy the patch. What is the most appropriate action to reduce risk during the gap?

   • AApply a temporary firewall rule to restrict access to the affected service
   • BDisable the antivirus software on the affected server to improve performance
   • CIncrease the frequency of end user awareness training
   • DWait for the change management process to complete before taking any action
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has an IPS deployed inline at the internet boundary. The IPS is generating a high number of false positives, causing legitimate traffic to be blocked. The security team is considering tuning the IPS to reduce false positives. What is the most important consideration when tuning the IPS?

   • ADisabling the IPS during business hours to avoid disruptions
   • BBalancing the reduction of false positives against the risk of missing real attacks
   • CEnsuring that the IPS is placed behind the firewall
   • DIncreasing the frequency of antivirus updates on the IPS
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A user receives a file attachment from an unknown sender. The antivirus software scans the file and detects a known malware signature, then quarantines it. Which two security practices are demonstrated in this scenario?

   • AEnd user awareness and intrusion prevention
   • BPatch management and heuristic analysis
   • CAntivirus signature-based detection and proactive threat blocking
   • DSecurity updates and firewall filtering
   Reveal Solution Discussion Select an answer first