Firewalls and Intrusion Detection Systems: Master Network Security

Question 1

Which of the following is **NOT** a type of firewall?

Accepted Answer

Network address translation (NAT) firewall

Answer

Packet filtering firewall

Answer

Stateful inspection firewall

Answer

Application-layer firewall

Question 2

What is the primary function of an intrusion detection system (IDS)?

Accepted Answer

To detect and report suspicious activities in a network

Answer

To prevent unauthorized access to a network

Answer

To block malicious traffic from entering a network

Answer

To encrypt network traffic

Question 3

Which of the following is a benefit of using a firewall?

Accepted Answer

Enhanced network protection

Answer

Improved network performance

Answer

Increased bandwidth

Answer

Reduced latency

Question 4

What is the distinction between a passive and an active intrusion detection system?

Accepted Answer

Passive IDS only monitor network traffic, while active IDS also respond to threats.

Answer

Active IDS only monitor network traffic, while passive IDS also respond to threats.

Answer

Passive IDS respond to threats, while active IDS only monitor network traffic.

Answer

There is no difference between passive and active intrusion detection systems.

Question 5

What is the key difference between a network-based intrusion detection system (NIDS) and a host-based intrusion detection system (HIDS)?

Accepted Answer

NIDS monitor network traffic, while HIDS monitor individual hosts.

Answer

HIDS monitor network traffic, while NIDS monitor individual hosts.

Answer

NIDS and HIDS both monitor network traffic.

Answer

NIDS and HIDS both monitor individual hosts.

Question 6

When implementing firewalls and intrusion detection systems (IDS), which of the following actions should be avoided?

Accepted Answer

Configuring IDS to alert for all events, regardless of importance

Answer

Deploying both firewalls and IDS for enhanced security

Answer

Regularly updating firewall and IDS software and signatures

Answer

Diligently monitoring firewall and IDS logs for security incidents

Question 7

Which of the following is NOT a primary advantage of using a firewall?

Accepted Answer

Boosting network performance

Answer

Preventing unauthorized network access

Answer

Stopping the spread of malware

Answer

Detecting and responding to intrusion attempts

Question 8

Which of the following is NOT a type of firewall?

Accepted Answer

Virtual private network

Answer

Packet-filtering

Answer

State-ful inspection

Answer

Web application

Question 9

Which of the following is a signature-based intrusion detection system?

Accepted Answer

Snort

Answer

Bro

Answer

OSSEC

Answer

Wireshark

Question 10

What is a false positive in intrusion detection?

Accepted Answer

A legitimate activity that triggers a detection

Answer

An attack that is detected but did not occur

Answer

An attack that is not detected when it occurs

Answer

An error in the detection system

Question 11

Which firewall management best practice promotes security?

Accepted Answer

Allowing only essential traffic

Answer

Permitting all traffic by default

Answer

Using overly complex rule sets

Answer

Updating rules infrequently

Question 12

What advantage do stateful inspection firewalls provide?

Accepted Answer

Tracking network connection state

Answer

Increased efficiency compared to other firewalls

Answer

Enhanced protection against spoofing

Answer

Simplified configuration

Question 13

Which firewall evasion technique involves changing ports frequently?

Accepted Answer

Port hopping

Answer

IP fragmentation

Answer

Packet tunneling

Answer

ARP poisoning

Question 14

How do anomaly-based and signature-based intrusion detection systems differ?

Accepted Answer

Anomaly-based systems detect deviations, while signature-based systems detect known patterns

Answer

Signature-based systems detect deviations, while anomaly-based systems detect known patterns

Answer

Anomaly-based systems are more accurate

Answer

Signature-based systems are more accurate

Question 15

Identify the type of firewall that does not exist:

Accepted Answer

Behavioral

Answer

Stateful

Answer

Packet-filtering

Answer

Proxy

Question 16

What is the key distinction between a firewall and an IDS?

Accepted Answer

Firewalls prevent unauthorized access, while IDSs detect malicious activity

Answer

IDSs prevent unauthorized access, while firewalls detect malicious activity

Answer

Firewalls and IDSs perform identical functions

Answer

IDSs are more efficient than firewalls

Question 17

What is the primary function of a honeypot in intrusion detection?

Accepted Answer

Luring attackers to monitor their activities

Answer

Blocking malicious traffic

Answer

Analyzing network traffic for suspicious patterns

Answer

Preventing unauthorized network access

Question 18

What is the primary objective of a network intrusion detection system (NIDS)?

Accepted Answer

Monitoring network traffic for suspicious activity

Answer

Preventing unauthorized network access

Answer

Detecting and responding to malicious activity on a host

Answer

Analyzing network traffic patterns

Question 19

Which of the following is NOT a type of firewall?

Accepted Answer

DNS firewall

Answer

Packet-filtering firewall

Answer

Stateful firewall

Answer

Application-layer firewall

Question 20

What is the primary purpose of an intrusion detection system (IDS)?

Accepted Answer

To detect and alert on potential security breaches

Answer

To prevent unauthorized network access

Answer

To block malicious traffic at the network edge

Answer

To conduct vulnerability assessments

Question 21

What is the key difference between a firewall and an IDS?

Accepted Answer

Firewalls prevent unauthorized access, while IDS detect breaches.

Answer

IDS prevent unauthorized access, while firewalls detect breaches.

Answer

Firewalls and IDS both prevent unauthorized access.

Answer

Firewalls and IDS both detect breaches.

Question 22

What is the main purpose of a proxy firewall?

Accepted Answer

To provide an additional layer of security by hiding internal network addresses

Answer

To improve performance by caching frequently accessed content

Answer

To enable remote access to internal resources

Answer

To filter traffic based on specific criteria

Question 23

What is the purpose of a security policy in relation to firewalls?

Accepted Answer

To define which traffic is allowed or blocked by the firewall

Answer

To document the security requirements for a network

Answer

To configure the firewall software

Answer

To monitor firewall logs for suspicious activity

Question 24

What is the role of a security information and event management (SIEM) system in relation to firewalls and IDS?

Accepted Answer

To collect and analyze logs from firewalls and IDS

Answer

To enforce firewall and IDS policies

Answer

To detect security breaches in real-time

Answer

To provide vulnerability management capabilities

Question 25

Which of the following is NOT a type of firewall?

Accepted Answer

Network-based intrusion detection system.

Answer

Packet filter

Answer

Stateful inspection

Answer

Proxy

Question 26

What is the primary function of an intrusion detection system?

Accepted Answer

Monitor network traffic for suspicious activity

Answer

Prevent unauthorized access to a network

Answer

Control the flow of data within a network

Answer

Encrypt sensitive information

Question 27

Which of the following is a benefit of using a stateful inspection firewall over a stateless inspection firewall?

Accepted Answer

Increased security

Answer

Improved performance

Answer

Simplified configuration

Answer

Enhanced logging capabilities

Question 28

What is the main difference between a signature-based IDS and an anomaly-based IDS?

Accepted Answer

Signature-based IDS detects known attacks, while anomaly-based IDS detects unknown attacks.

Answer

Anomaly-based IDS detects known attacks, while signature-based IDS detects unknown attacks.

Answer

Both types of IDS detect known attacks.

Answer

Both types of IDS detect unknown attacks.

Question 29

Which of the following is a best practice when implementing a firewall?

Accepted Answer

Configure the firewall to block all incoming connections except those explicitly allowed

Answer

Allow all incoming connections

Answer

Use default firewall settings

Answer

Enable remote access without restrictions.

Question 30

What is the primary difference between a firewall rule and an intrusion detection system rule?

Accepted Answer

Firewall rules control network traffic, while IDS rules detect malicious activity.

Answer

IDS rules control network traffic, while firewall rules detect malicious activity.

Answer

Firewall rules and IDS rules perform the same function.

Answer

There is no difference between firewall rules and IDS rules.

Question 31

To minimize false positives in intrusion detection systems, which approach is recommended?

Accepted Answer

Adjust detection thresholds

Answer

Disable anomaly-based detection

Answer

Ignore low-priority alerts

Answer

Increase the number of sensors

Question 32

What is the key difference between a stateful inspection firewall and a packet filtering firewall?

Accepted Answer

Stateful inspection firewalls track network connection states, unlike packet filtering firewalls.

Answer

Packet filtering firewalls are more efficient than stateful inspection firewalls.

Answer

Stateful inspection firewalls are less secure than packet filtering firewalls.

Answer

Stateful inspection firewalls are more difficult to configure than packet filtering firewalls.

Question 33

Which type of firewall inspects traffic based on pre-defined rules, typically used at the network perimeter?

Accepted Answer

Packet-filtering firewall

Answer

Stateful firewall

Answer

Application-layer firewall

Answer

Proxy firewall

Question 34

What is a key advantage of using a stateful firewall?

Accepted Answer

It tracks network connections, permitting legitimate responses to pass through.

Answer

It filters traffic based on packet headers only.

Answer

It blocks all traffic from unknown sources.

Question 35

Which intrusion detection system (IDS) technique proactively monitors network traffic for anomalous patterns?

Accepted Answer

Anomaly-based IDS

Answer

Signature-based IDS

Answer

Stateful IDS

Answer

Heuristic-based IDS

Question 36

In the context of intrusion detection, what is a false negative?

Accepted Answer

An attack or intrusion that the IDS fails to detect.

Answer

An attack or intrusion that the IDS detects but is benign.

Answer

A legitimate activity that the IDS flags as malicious.

Question 37

What is the primary purpose of a network intrusion detection system (NIDS)?

Accepted Answer

To monitor network traffic and identify suspicious activities in real-time.

Answer

To block network attacks in real-time.

Answer

To encrypt network traffic.

Question 38

In the context of intrusion detection, what is a false positive?

Accepted Answer

An IDS alert triggered by non-malicious activity.

Answer

An IDS alert that is ignored by the security team.

Answer

An attack or intrusion that is not detected by the IDS.

Question 39

What is the purpose of port scanning in network security?

Accepted Answer

To identify open ports and potential vulnerabilities on a network.

Answer

To intercept and modify network traffic.

Answer

To encrypt network data.

Question 40

Which of the following is NOT a type of firewall?

Accepted Answer

Behavioral firewall

Answer

Stateful firewall

Answer

Application-layer firewall

Answer

Packet-filtering firewall

Question 41

What is the main purpose of an intrusion detection system (IDS)?

Accepted Answer

To detect and respond to unauthorized access attempts

Answer

To filter incoming traffic based on rules

Answer

To prevent unauthorized access to a network

Answer

To block all incoming network traffic

Question 42

Which of the following is a type of IDS sensor?

Accepted Answer

Network intrusion detection sensor (NIDS)

Answer

Antivirus software

Answer

Firewall

Answer

Spam filter

Question 43

What is the difference between a signature-based IDS and an anomaly-based IDS?

Accepted Answer

A signature-based IDS detects known threats, while an anomaly-based IDS detects deviations from normal behavior

Answer

A signature-based IDS is more accurate, while an anomaly-based IDS is more efficient

Question 44

Which of the following is a benefit of using a firewall?

Accepted Answer

Increased network security

Answer

Easier network management

Answer

Reduced hardware costs

Answer

Improved network performance

Question 45

What is the key difference between a stateful firewall and a stateless firewall?

Accepted Answer

A stateful firewall tracks the state of network connections, while a stateless firewall does not

Answer

A stateful firewall is more efficient, while a stateless firewall is more secure

Answer

A stateful firewall is more complex to configure, while a stateless firewall is easier to configure

Question 46

What is the primary purpose of a honeypot in network security?

Accepted Answer

To deceive and trap attackers

Answer

To prevent unauthorized access to a network

Answer

To detect unauthorized access attempts

Question 47

What is the main difference between a network-based IDS and a host-based IDS?

Accepted Answer

A network-based IDS monitors network traffic, while a host-based IDS monitors a specific host

Answer

A network-based IDS is faster, while a host-based IDS is more complex

Answer

A network-based IDS is more accurate, while a host-based IDS is more efficient