2.5 Explain the Limitations of Signature-Based Network Protection CYBERSECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why does signature update latency pose a risk to network security?

   • AIt leaves a window of time where new threats are not detected
   • BIt prevents the device from inspecting encrypted traffic
   • CIt reduces the performance of the security device
   • DIt causes the security device to reboot frequently
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security administrator is reviewing the logs of a signature-based IPS. They find that a critical vulnerability was exploited on a server, but the IPS did not generate an alert. The vulnerability was publicly disclosed three days ago, and the vendor released a signature for it yesterday. Which limitation of signature-based detection is most directly demonstrated?

   • APerformance overhead causing dropped packets
   • BFalse negative due to signature update latency
   • CFalse positive due to a broad signature
   • DInability to detect encrypted traffic
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security architect is designing a layered defense for a financial institution. The institution handles highly sensitive data and is a likely target for advanced persistent threats (APTs). The architect knows that signature-based detection alone is insufficient. Which additional measure would be most effective in detecting the early stages of an APT, which often uses legitimate tools and unknown exploits?

   • ADeploying a more comprehensive signature database.
   • BEnabling SSL decryption on all traffic.
   • CImplementing user and entity behavior analytics (UEBA).
   • DIncreasing the frequency of signature updates.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company's security team is evaluating a new signature-based IPS. During the evaluation, they find that the IPS is not detecting a known exploit that is being sent in a fragmented manner. The IPS is configured to inspect packets individually. Which configuration change would most likely improve detection of this fragmented attack?

   • AIncrease the signature update frequency.
   • BEnable SSL decryption.
   • CDisable the IPS and use a firewall instead.
   • DEnable stream reassembly on the IPS.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Why does encrypted traffic present a challenge for signature-based network protection?

   • AThe system cannot inspect the payload of encrypted traffic without decryption
   • BThe signature database cannot store encrypted patterns
   • CEncrypted traffic bypasses the network stack, so signatures cannot be applied
   • DEncrypted traffic is always malicious and should be blocked
   Reveal Solution Discussion Select an answer first