CCNA Cybersecurity Intrusion Detection Basics

1. Which protocol analysis feature helps IDS detect protocol-based attacks?

Packet fragmentation

Deep Packet Inspection (DPI)

Flow analysis

Bandwidth throttling

Submit

3. What is the primary role of correlation in IDS/IPS systems?

Encrypting alert data

Linking multiple events to identify coordinated attacks

Reducing network latency

Compressing log files

4. True or False: NIDS can detect attacks on all network segments simultaneously.

True

False

Submit

6. Which IDS/IPS mode allows traffic to pass while logging suspicious activity?

Blocking mode

Monitoring mode

Prevention mode

Reactive mode

7. In IDS/IPS tuning, what is a whitelist used for?

Blocking known malware

Identifying trusted sources and reducing false positives

Encrypting network traffic

Monitoring bandwidth usage

8. What is the primary advantage of anomaly-based detection?

Low processing overhead

Can detect novel and zero-day attacks

No false positives

Works on all encryption types

9. True or False: Signature-based detection is effective against unknown threats.

True

False

Submit

11. What is the primary difference between an IDS and an IPS?

IDS detects threats; IPS detects and prevents threats

IDS is faster than IPS

IPS only works on wireless networks

IDS requires more processing power

12. What does the term 'inline' mean in IPS deployment?

IPS is installed on a separate monitoring port

IPS sits directly in the data path and can block traffic

IPS operates only during business hours

IPS monitors only inbound traffic

13. True or False: An IPS can operate in passive mode without blocking traffic.

True

False

14. Which Cisco IDS/IPS product is designed for enterprise networks?

Cisco ASA 5500-X

Cisco Catalyst 9000

Cisco Firepower 4100 Series

Cisco Meraki MX

All of the above

15. What is a false positive in IDS context?

Failing to detect a real attack

Detecting legitimate traffic as malicious

Missing encrypted threats

Blocking all network traffic

Submit

17. Which of the following is a limitation of signature-based detection?

It consumes excessive bandwidth

It cannot detect zero-day attacks

It only works on encrypted traffic

It requires manual packet inspection

18. What does HIDS monitor?

Network traffic patterns

Host system logs and file integrity

Wireless signals

DNS queries

19. In network-based IDS (NIDS), where is the sensor typically placed?

Only on servers

At network segments to monitor traffic

Inside individual user devices

On the internet gateway only

20. Which detection method identifies attacks based on known malicious signatures?

Anomaly-based detection

Signature-based detection

Behavioral detection

Heuristic detection

CCNA Cybersecurity Intrusion Detection Basics Quiz

1. Which protocol analysis feature helps IDS detect protocol-based attacks?

2.

What first name or nickname would you like us to use?

2. Cisco Firepower Threat Defense (FTD) combines firewall and ____ capabilities.

3. What is the primary role of correlation in IDS/IPS systems?

4. True or False: NIDS can detect attacks on all network segments simultaneously.

5. A ____-based IDS signature identifies attacks by matching known malicious patterns.

6. Which IDS/IPS mode allows traffic to pass while logging suspicious activity?

7. In IDS/IPS tuning, what is a whitelist used for?

8. What is the primary advantage of anomaly-based detection?

9. True or False: Signature-based detection is effective against unknown threats.

10. A zero-day attack is one that exploits a vulnerability ____.

11. What is the primary difference between an IDS and an IPS?

12. What does the term 'inline' mean in IPS deployment?

13. True or False: An IPS can operate in passive mode without blocking traffic.

14. Which Cisco IDS/IPS product is designed for enterprise networks?

15. What is a false positive in IDS context?

16. Anomaly-based detection identifies threats by comparing current activity to a ____.

17. Which of the following is a limitation of signature-based detection?

18. What does HIDS monitor?

19. In network-based IDS (NIDS), where is the sensor typically placed?

20. Which detection method identifies attacks based on known malicious signatures?