2.5 Explain the Limitations of Signature-Based Network Protection CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is investigating a malware infection. The analyst finds that the malware is using a technique where the malicious code is encoded and then decoded at runtime. The signature-based IPS did not detect the malware because the encoded version did not match any known signature. Which evasion technique is being used?

   • AProtocol tunneling
   • BEncryption
   • CFragmentation
   • DObfuscation
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst at a mid-sized company notices that a known malware variant, which was widely reported in threat feeds two weeks ago, has been successfully executing on several endpoints. The company's next-generation firewall (NGFW) has signature-based IPS enabled with automatic updates. The malware uses a simple encoding scheme to alter its byte pattern on each infection. Which limitation of signature-based detection best explains why the IPS failed to block this threat?

   • AThe IPS lacks the processing power to perform deep packet inspection on all traffic.
   • BThe firewall's IPS was configured to only log, not block, new signatures.
   • CThe IPS cannot inspect traffic that is encrypted with TLS.
   • DThe signature update latency meant the IPS did not yet have a signature for this specific encoded variant.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team is testing their IPS. They send a known exploit to a test server, but the IPS does not block it. Upon investigation, they find that the exploit payload has been modified by inserting benign characters between the command and its arguments. The overall functionality of the exploit is unchanged. Which evasion technique is being used?

   • AFragmentation
   • BProtocol tunneling
   • CObfuscation
   • DEncryption
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security manager is reviewing the company's network security posture. The company relies on a signature-based IPS. Recently, a zero-day attack bypassed the IPS, and the IPS also generated a high volume of false positives for a new internal application. The manager wants to improve detection without replacing the IPS. Which combination of complementary measures would best address both the zero-day gap and the false positive issue?

   • AIncrease the IPS inspection buffer size and enable SSL decryption.
   • BDeploy a second IPS from a different vendor and aggregate alerts.
   • CDisable the IPS and rely on endpoint protection.
   • DDeploy a behavioral analysis tool and fine-tune the IPS signatures to reduce false positives.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A network administrator is explaining to a junior analyst how their signature-based IPS works. The administrator wants to clarify why the IPS can detect a known exploit but not a slightly modified version of it. Which statement best describes the underlying mechanism?

   • AThe IPS uses machine learning to identify new and unknown threats.
   • BThe IPS compares the traffic against a database of known attack patterns and flags exact or near-exact matches.
   • CThe IPS blocks all traffic that is not explicitly allowed by policy.
   • DThe IPS analyzes the behavior of the traffic to determine if it is malicious.
   Reveal Solution Discussion Select an answer first