1.5 Identify and Describe Threat Prevention Systems and Practices (e.g., End User Awareness, Security Updates, Antivirus, Intrusion Prevention Systems, Firewalls) CYBERSECURITY-APPRENTICE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is reviewing logs and notices that an intrusion prevention system (IPS) blocked a series of packets that matched a known exploit signature. The analyst also sees that the firewall allowed the traffic because it matched an allow rule. What does this scenario demonstrate about the relationship between the IPS and the firewall?

   • AThe IPS is redundant because the firewall already allowed the traffic
   • BThe IPS should be placed outside the firewall to be more effective
   • CThe firewall is misconfigured and should be replaced by the IPS
   • DThe IPS provides an additional layer of defense beyond the firewall's rule-based filtering
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the main purpose of applying security updates and patches to software?

   • ATo fix known vulnerabilities that could be exploited by attackers
   • BTo increase the speed of the software
   • CTo add new features that improve user productivity
   • DTo change the user interface to make it more intuitive
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which combination of practices best illustrates a defense-in-depth approach?

   • AApplying security patches to the operating system only
   • BConducting regular phishing simulations for all employees
   • CInstalling antivirus software on all workstations and servers
   • DUsing a firewall, intrusion prevention system, antivirus, and end user awareness training together
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How does an intrusion prevention system differ from an intrusion detection system (IDS)?

   • AAn IPS is a software-only solution, while an IDS is hardware-only
   • BAn IPS uses signatures, while an IDS uses only heuristics
   • CAn IPS can actively block malicious traffic, while an IDS typically only alerts
   • DAn IPS is only used for wireless networks, while an IDS is for wired networks
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has implemented a defense-in-depth strategy that includes a firewall, an IPS, antivirus on all endpoints, and regular security updates. Despite these controls, a recent malware infection occurred when an employee plugged an infected USB drive into a laptop. The malware was not detected by the antivirus because it was a new variant. Which additional layer would have most likely prevented this specific infection?

   • AIncreased frequency of security updates
   • BEndpoint detection and response (EDR) with behavioral analysis
   • CMore end user awareness training
   • DA more restrictive firewall rule set
   Reveal Solution Discussion Select an answer first