CND Firewall and IDS Configuration Quiz

1. Which IDS detection method uses predefined patterns?

Anomaly-based detection

Signature-based detection

Behavioral-based detection

Heuristic-based detection

2. In firewall logging, which event is most critical to monitor?

All permitted traffic

Denied connection attempts

Routine DNS queries

Internal traffic only

3. What is the primary function of a reverse proxy firewall?

Block incoming connections

Protect internal servers from direct exposure

Encrypt all traffic

Monitor user activity

4. Which IDS mode operates passively without blocking traffic?

Inline mode

Passive mode

Active mode

Blocking mode

5. What is a firewall ACL entry that permits SSH traffic on port 22?

Permit tcp any any eq 22

Deny tcp any any eq 22

Allow ssh port 22

Filter tcp 22 permit

6. Which firewall approach uses zones to segment networks?

Proxy firewall

Next-generation firewall

Zone-based firewall

Packet-filter firewall

7. In IDS, what does 'tuning' refer to?

Adjusting sensitivity to reduce false positives

Updating firewall rules

Encrypting network traffic

Backing up configuration files

8. What is the primary advantage of HIDS over NIDS?

Lower cost implementation

Can monitor encrypted traffic on the host

Faster network scanning

Easier to manage centrally

9. Which of the following is a common default deny firewall policy?

Allow all, deny specific

Deny all, allow specific

Allow HTTP and HTTPS only

Block only known malware

10. What is port filtering in firewall configuration?

Blocking all UDP traffic

Allowing or blocking traffic based on port numbers

Encrypting specific ports

Monitoring port availability

11. Which OSI layer does a stateless firewall primarily operate on?

Layer 2 (Data Link)

Layer 3 (Network)

Layer 4 (Transport)

Layer 7 (Application)

12. In firewall configuration, what does 'implicit deny' mean?

All traffic is allowed by default

Traffic not explicitly permitted is denied

Denial of service attacks are prevented

User authentication is required

13. What does DMZ stand for in network security?

Data Management Zone

Demilitarized Zone

Direct Memory Zone

Distributed Malware Zone

14. Which protocol is typically used for IDS alert logging?

SMTP

Syslog

SNMP

DNS

15. What is a false positive in IDS detection?

Missed attack detection

Legitimate traffic flagged as malicious

Firewall rule misconfiguration

Encrypted traffic rejection

16. Which firewall rule type is evaluated first in most configurations?

Permit rules

Deny rules

Explicit rules (in order)

Default rules

17. What is a signature in IDS terminology?

A digital certificate

A pattern of known attack traffic

An encryption key

A user authentication token

18. Which type of IDS monitors network traffic in real-time?

HIDS (Host-based IDS)

NIDS (Network-based IDS)

AIDS (Application-based IDS)

LIDS (Log-based IDS)

19. In an ACL, what does the 'deny' rule do?

Permits traffic matching the criteria

Blocks traffic matching the criteria

Logs all traffic

Encrypts the traffic

20. What is the primary difference between a stateful and stateless firewall?

Stateful tracks connection states; stateless does not

Stateless is faster but less secure

Stateful only works at Layer 2

Stateless uses more memory