Crowdly

Which intrusion detection method uses a baseline model of normal behavior to identify potential threats?

Signature-based detection

Anomaly-based detection

Policy-based detection

Protocol-based detection

A Next-Generation Firewall differs from a traditional firewall by integrating which additional capabilities?

Basic packet filtering and port-based blocking only

. Intrusion Prevention Systems deep packet inspection, and application awareness

100%

Hardware-level physical locks and biometric authentication

Circuit-level session validation without inspecting data content

Why might a Proxy (Application-level) Firewall create significant slowdown in network performance?

It must terminate connections and perform deep-layer packet inspection on the content

It requires the host to constantly update its checksum database

It lacks the hardware to handle basic packet filtering

It only operates at layer 3 of the OSI model

When configuring firewall rules, what is the primary difference between a 'Drop' action and a 'Reject' action?

'Drop' silently discards the packet, while 'Reject' sends an error message back to the source

'Drop' allows the packet but logs it, while 'Reject' prevents the transmission

'Drop' is used for outbound traffic, while 'Reject' is strictly for inbound traffic

'Drop' requires manual approval from an admin, while 'Reject' is automated

How does a Host-based Intrusion Detection System primarily monitor for unauthorized modifications to system files?

By strictly enforcing decryption on the local machine

By initializing and scanning objects to create a checksum database

By blocking all incoming packets at the network interface card

By acting as a man-in-the-middle proxy for all web traffic

What is the fundamental difference in the response mechanism between an Intrusion Detection System and an Intrusion Prevention System?

. IDS monitors host devices, while IPS only monitors network traffic.

IDS is positioned inline, while IPS is positioned out-of-band.

IDS Uses anomaly-based detection, while IPS only uses signature-based detection

IDS is passive and alerts administrators, while IPS is active and blocks threats in real-time

100%

Which component does a stateful firewall use to track active connections and make context-aware filtering decisions?

Application-level proxy

Static access control list

State table

100%

Checksum database