Intrusion Prevention

Question 1 of 6

What is the key functional difference between an IDS and an IPS?

A. An IDS uses signature-based detection; an IPS uses only anomaly-based detection B. An IDS generates alerts but cannot block traffic; an IPS can block malicious traffic in real time C. An IDS is always deployed inline; an IPS is always deployed passively D. An IDS monitors inbound traffic only; an IPS monitors both inbound and outbound traffic

Question 2 of 6

An inline IPS fails due to a hardware fault. The device is configured fail-open. What happens to network traffic during the failure?

A. Traffic continues to flow through the device without inspection until the device is repaired B. Traffic is halted; the network link is severed until the device is restored C. The device automatically switches to passive monitoring mode and sends alerts only D. The firewall assumes IPS functions and continues blocking malicious traffic

Question 3 of 6

A security architect needs to monitor traffic on a SCADA network that controls physical manufacturing equipment. Any device failure must have zero impact on the SCADA network's operation. Which monitoring configuration is MOST appropriate?

A. Inline IPS configured fail-open B. Inline IPS configured fail-closed C. Passive IDS receiving traffic copies via SPAN port D. Inline IPS with redundant hardware failover

Question 4 of 6

An organization deploys an IPS appliance connected to a SPAN port on their core switch. A SQL injection attack reaches the database server. The IPS generates an alert. What does this scenario demonstrate?

A. The IPS failed — it should have blocked the attack before it reached the database B. The IPS is operating correctly in passive mode — it detected the attack but could not block it because it is not inline C. SPAN ports cannot be used with IPS devices — only with dedicated IDS hardware D. The signature database needs to be updated — the attack was detected but not recognized as high severity

Question 5 of 6

Which failure mode should a hospital choose for an inline IPS protecting its clinical network, and why?

A. Fail-closed, because clinical data is highly sensitive and uninspected traffic must never be permitted B. Fail-open, because network downtime in a clinical environment creates patient safety risks that outweigh the risk of a brief inspection gap C. Fail-closed, because HIPAA regulations require fail-closed for all inline healthcare security devices D. Fail-open, because clinical networks are low-risk environments that do not need continuous inspection

Question 6 of 6

A security team needs to monitor a high-speed 10Gbps link for forensic purposes. They require 100% packet capture fidelity — no dropped copies. Which traffic copy method is MOST appropriate?

A. SPAN port (port mirror) on the switch B. Physical network tap inserted into the cable C. Inline IPS in active monitoring mode D. NetFlow records from the router

Matching

Match each description to the intrusion detection/prevention concept it best represents.

1. A security device that sits directly in the network traffic path and can drop malicious packets before they reach their destination

2. A security device that generates alerts when it identifies suspicious traffic but cannot stop that traffic from reaching its destination

3. A device failure behavior in which traffic continues to flow through a failed inline security device without inspection

4. A switch feature that duplicates traffic from specified ports and delivers copies to a monitoring device without impacting the original traffic flow

1. 2. 3. 4.

A. IDS (passive)

B. Fail-open

C. Active monitoring / inline IPS

D. SPAN port (port mirror)

Intrusion Prevention Quiz

Matching