2.5 Explain the Limitations of Signature-Based Network Protection CYBERSECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An attacker is using a technique where malicious commands are sent over DNS queries to a server the attacker controls. The DNS traffic is allowed through the firewall. The signature-based IPS does not detect the malicious activity because it is embedded in a protocol that is typically allowed. Which evasion technique is being used?

   • AEncryption
   • BFragmentation
   • CProtocol tunneling
   • DObfuscation
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A network administrator is troubleshooting why a signature-based IPS did not alert on a malicious payload. The payload was split across multiple TCP segments, with each segment being smaller than the IPS's inspection buffer. The IPS reassembled the stream but the attack pattern was not detected. Which evasion technique is most directly responsible for this failure?

   • APayload obfuscation
   • BEncrypted traffic
   • CProtocol tunneling
   • DTraffic fragmentation
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is considering moving from a signature-based IPS to a next-generation firewall (NGFW) with integrated threat prevention. The company's main concern is a recent string of zero-day attacks in their industry. The security team wants to ensure the new solution can detect these unknown threats. Which capability should the team prioritize in their evaluation?

   • AThe speed at which the vendor releases new signatures.
   • BThe ability to perform behavioral analysis and anomaly detection.
   • CThe throughput of the firewall to handle high traffic volumes.
   • DThe number of signatures included in the subscription.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary requirement for a signature-based detection system to identify a threat?

   • AThe threat must originate from an external network
   • BThe threat must be encrypted to be detected
   • CThe threat must have been previously observed and a signature created for it
   • DThe threat must be actively exploiting a vulnerability at the time of detection
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security operations center (SOC) is experiencing a high volume of alerts from their signature-based IPS. The SOC manager suspects that many of these alerts are false positives. The manager wants to confirm this and reduce the noise. Which action would be the most appropriate first step?

   • AReview the alerts and correlate them with known legitimate traffic and applications.
   • BIncrease the severity threshold for all alerts.
   • CAdd more signatures to the IPS to improve detection.
   • DDisable the IPS signatures that are generating the most alerts.
   Reveal Solution Discussion Select an answer first