IDS & IPS (Network+) Quiz: Detection vs. Prevention

1. Which of the following is a true statement about IPS systems?

IPS can only operate in passive mode

IPS can drop or reset malicious connections

IPS cannot inspect encrypted traffic

IPS replaces the need for firewalls

Submit

3. Which deployment model combines IDS and IPS capabilities for comprehensive threat management?

Hybrid architecture

Redundant systems

Distributed sensors

All of the above

Submit

5. What is a key consideration when tuning IDS/IPS sensitivity?

Higher sensitivity always equals better security

Balance between detection rate and false positive rate

IPS should block 100% of traffic

Sensitivity cannot be adjusted after deployment

Submit

7. Which type of alert response is NOT typically available in an IPS system?

Block the source IP address

Reset the TCP connection

Physically isolate the network segment

Drop the malicious packet

Submit

9. What is a potential drawback of inline IPS deployment?

It cannot detect threats

It introduces latency and becomes a single point of failure

It only works on wired networks

It requires continuous signature updates

Submit

11. What is the primary difference between an IDS and an IPS?

IDS detects threats; IPS detects and blocks threats

IDS prevents attacks; IPS only alerts

IDS is software-only; IPS is hardware-only

IDS monitors internal networks; IPS monitors external only

12. What is a false positive in the context of IDS/IPS systems?

An alert triggered for legitimate traffic

A missed attack that went undetected

A system crash during packet inspection

An attacker bypassing the system

Submit

14. A network-based IDS (NIDS) monitors traffic at which layer of the OSI model?

Layer 1 (Physical)

Layer 3 (Network)

Layer 4 (Transport)

Layers 3 and above

15. Which IDS/IPS detection type can identify previously unknown attacks?

Signature-based

Anomaly-based

Protocol-based

Policy-based

Submit

17. What is a key limitation of signature-based IDS/IPS systems?

They cannot detect zero-day exploits

They require too much bandwidth

They only work on wireless networks

They block all traffic automatically

18. Which signature-based detection method identifies attacks by comparing network patterns to known malicious signatures?

Anomaly detection

Behavioral detection

Signature detection

Heuristic detection

Submit

20. Which deployment mode places an IDS/IPS inline with network traffic?

Tap mode

Inline mode

Passive mode

Monitor mode

IDS/IPS Quiz: Detect or Prevent?

1. Which of the following is a true statement about IPS systems?

2.

What first name or nickname would you like us to use?

2. Regular ____ of IDS/IPS signatures is critical to detect emerging threats.

3. Which deployment model combines IDS and IPS capabilities for comprehensive threat management?

4. Encrypted traffic presents a challenge to IDS/IPS systems because ____ cannot be inspected.

5. What is a key consideration when tuning IDS/IPS sensitivity?

6. A SIEM system is often integrated with IDS/IPS to provide ____ and correlation.

7. Which type of alert response is NOT typically available in an IPS system?

8. Protocol-based IDS/IPS detection identifies violations of ____ standards.

9. What is a potential drawback of inline IPS deployment?

10. In an inline IPS deployment, the system must be positioned ____ the traffic path.

11. What is the primary difference between an IDS and an IPS?

12. What is a false positive in the context of IDS/IPS systems?

13. Host-based IDS (HIDS) differs from NIDS in that it monitors activity on a ____.

14. A network-based IDS (NIDS) monitors traffic at which layer of the OSI model?

15. Which IDS/IPS detection type can identify previously unknown attacks?

16. Anomaly-based detection works by establishing a ____ of normal network behavior.

17. What is a key limitation of signature-based IDS/IPS systems?

18. Which signature-based detection method identifies attacks by comparing network patterns to known malicious signatures?

19. An IDS that copies traffic from a network tap is operating in ____ mode.

20. Which deployment mode places an IDS/IPS inline with network traffic?