CNDA Firewall Technologies and IDS/IPS 1 — Questions and Answers
Question 1: Which firewall type inspects the full context of a TCP session rather than individual packets?
- Packet filter firewall
- Stateful inspection firewall (Correct answer)
- Proxy firewall
- Next-generation firewall
Correct answer: Stateful inspection firewall
A stateful firewall tracks the state of active connections and uses this context to determine whether packets belong to a legitimate session.
Question 2: What distinguishes a next-generation firewall (NGFW) from a traditional stateful firewall?
- NGFW only filters at Layer 3
- NGFW adds application-layer inspection, user identity awareness, and integrated IPS (Correct answer)
- NGFW cannot perform NAT
- NGFW uses only signature-based detection
Correct answer: NGFW adds application-layer inspection, user identity awareness, and integrated IPS
An NGFW combines stateful inspection with deep packet inspection, application identification, user-based policies, and IPS capabilities.
Question 3: An IDS detects a known attack signature. What is the IMMEDIATE response it takes by default?
- Blocks the connection automatically
- Sends an alert to the administrator (Correct answer)
- Resets the attacker's TCP session
- Quarantines the source IP
Correct answer: Sends an alert to the administrator
An IDS (Intrusion Detection System) is a passive device that generates alerts; it does not block traffic by default.
Question 4: Which IDS/IPS detection method identifies attacks by comparing traffic to known bad patterns?
- Anomaly-based detection
- Heuristic detection
- Signature-based detection (Correct answer)
- Behavioral analysis
Correct answer: Signature-based detection
Signature-based detection matches traffic against a database of known attack patterns, making it effective against known threats.
Question 5: A firewall rule set should follow which ordering principle for efficiency and security?
- Most permissive rules first
- Most specific rules first, with a deny-all at the bottom (Correct answer)
- Rules in alphabetical order
- Deny-all at the top, allow rules at the bottom
Correct answer: Most specific rules first, with a deny-all at the bottom
Specific rules should precede general ones, and an implicit or explicit deny-all at the end ensures no unauthorized traffic passes.
Question 6: What is the primary risk of placing an IDS sensor outside the perimeter firewall?
- It will only see encrypted traffic
- It generates excessive false positives from internet noise but misses post-filter attacks (Correct answer)
- It cannot detect internal threats
- It requires more storage
Correct answer: It generates excessive false positives from internet noise but misses post-filter attacks
An external IDS sees all raw internet traffic, producing high false-positive rates, but traffic blocked by the firewall never reaches internal systems.
