Detailed Explanations for Questions 301-350
Q301 & Q306. What is the difference between a traditional firewall and an IPS?
- A. Firewalls don’t generate logs.
- B. An IPS cannot drop packets.
- C. An IPS does not follow rules.
- D. An IPS can inspect and drop packets. ✓
Why D is correct: An Intrusion Prevention System (IPS) sits inline with traffic and has the capability to actively inspect packet contents and drop malicious packets in real-time. A traditional firewall primarily filters based on IP addresses, ports, and protocols (Layer 3/4) and typically allows or blocks based on rules without deep inspection or active dropping of specific malicious payloads identified by signatures.
Why others are incorrect:
- A: Both firewalls and IPS generate logs; logging is a standard feature for auditing and troubleshooting.
- B: The primary function of an IPS is to prevent intrusions, which includes dropping packets.
- C: An IPS follows a defined set of rules or signatures to identify malicious traffic; it does not act randomly.
Q302. You are the security administration for your local city. You just installed a new IPS. Other than plugging it in and applying some basic IPS rules, no other configuration has been made. You come in the next morning, and you discover that there was so much activity generated by the IPS in the logs that it is too time-consuming to view. What most likely caused the huge influx of logs from the IPS?
- A. The clipping level was established.
- B. A developer had local admin rights.
- C. The LAN experienced a switching loop.
- D. The new rules were poorly designed. ✓
Why D is correct: If an IPS is installed with default or poorly tuned rules, it may generate excessive false positives (alerting on legitimate traffic as malicious). Without proper tuning or baseline establishment, the volume of alerts can become unmanageable.
Why others are incorrect:
- A: Establishing a clipping level (threshold for alerting) would typically reduce log volume by ignoring minor events, not increase it.
- B: A developer having admin rights is a security risk but wouldn’t directly cause a massive influx of IPS logs unless they were triggering rules, which points back to rule design.
- C: A switching loop causes broadcast storms and network congestion, not necessarily a high volume of IPS security alerts.
Q303. Why would the adversary encode their payload before sending it to the target victim?
- A. Encoding the payload will not provide any additional benefit.
- B. By encoding the payload, the adversary actually encrypts the payload.
- C. The encoded payload can bypass the firewall because there is no port associated with the payload.
- D. Encoding the payload may bypass IPS/IDS detection because it changes the signature. ✓
Why D is correct: Encoding (e.g., URL encoding, Base64, Unicode) changes the byte pattern of the payload without changing its functionality. This alters the signature of the attack, potentially allowing it to evade signature-based IPS/IDS detection that is looking for the original, unencoded pattern.
Why others are incorrect:
- A: Encoding provides the benefit of evasion.
- B: Encoding is not encryption; encoding is reversible without a key, whereas encryption requires a key.
- C: Firewalls filter based on ports and protocols; encoding the payload does not change the port used for transmission.
Q304. Of the following methods, which one acts as a middleman between an external network and the private network by initiating and establishing the connection?
- A. Proxy server ✓
- B. Firewall
- C. Router
- D. Switch
Why A is correct: A proxy server acts as an intermediary. When an internal client requests a resource, the proxy initiates a new connection to the external server on behalf of the client. This hides the internal client’s IP address and allows the proxy to inspect and filter the traffic.
Why others are incorrect:
- B: A firewall filters traffic but typically allows the connection to flow through (unless it’s a specific application proxy firewall); it doesn’t necessarily initiate a new connection on behalf of the client in the same way a proxy does.
- C: A router forwards packets based on IP addresses; it does not initiate connections.
- D: A switch forwards frames based on MAC addresses within a LAN; it does not initiate connections between networks.
Q305. Which type of firewall would you use if you wanted to have the firewall check for malware as it passed through the firewall?
- A. Web application firewall
- B. Stateful firewall
- C. Next-generation firewall ✓
- D. Stateless firewall
Why C is correct: Next-Generation Firewalls (NGFW) integrate traditional firewall capabilities with additional features like intrusion prevention, application awareness, and often integrated malware scanning/antivirus capabilities to inspect traffic for malicious code.
Why others are incorrect:
- A: A WAF specifically protects web applications from attacks like SQLi and XSS, but doesn’t necessarily scan for general malware files passing through.
- B: A stateful firewall tracks connection states but typically does not perform deep file inspection for malware.
- D: A stateless firewall filters based on individual packet headers without tracking state, and definitely does not scan for malware.
Q307. Which type of firewall would operate at layer 7 of the OSI model?
- A. Stateful firewall
- B. Deep packet inspection firewall
- C. Web application firewall ✓
- D. Access control list
Why C is correct: A Web Application Firewall (WAF) is designed specifically to monitor and filter HTTP/HTTPS traffic, which operates at Layer 7 (Application layer). It understands web application logic to block attacks like SQL injection and XSS.
Why others are incorrect:
- A: Stateful firewalls primarily operate at Layer 4 (Transport), tracking TCP/UDP sessions.
- B: Deep packet inspection can occur at various layers, but WAF is the specific term for Layer 7 web traffic protection.
- D: ACLs are typically implemented on routers/firewalls at Layers 3 and 4.
Q308. A stateful firewall device operates at what layer of the OSI model?
- A. Layer 2
- B. Layer 4 ✓
- C. Layer 7
- D. Layer 3
Why B is correct: Stateful firewalls operate primarily at Layer 4 (Transport Layer). They track the state of active connections (TCP handshakes, UDP streams) to make filtering decisions based on the context of the traffic, not just individual packets.
Why others are incorrect:
- A: Layer 2 is the Data Link layer (switches, bridges).
- C: Layer 7 is the Application layer (WAF, Proxy).
- D: Layer 3 is the Network layer (packet filtering firewalls/routers), but stateful inspection adds Layer 4 context.
Q309. What type of control is a firewall?
- A. Barrier
- B. Administrator
- C. Logical ✓
- D. Physical
Why C is correct: A firewall is a logical (or technical) control. It is a software or hardware mechanism that enforces security policies through logic and configuration, rather than physical barriers or administrative policies.
Why others are incorrect:
- A: “Barrier” is a generic term, often associated with physical controls.
- B: “Administrator” refers to a role or administrative control.
- D: Physical controls are tangible measures like locks, guards, or fences.
Q310, Q311, & Q312. A firewall that blocks all traffic by default is known as what? / What is the default security posture of a secure firewall?
- A. Implicit allow
- B. Implicit deny ✓
- C. Deny all
- D. Implicit prevent all
Why B is correct: “Implicit Deny” is the security principle where a firewall denies all traffic by default unless a rule explicitly allows it. This is the safest default posture.
Why others are incorrect:
- A: Implicit Allow would allow all traffic unless explicitly blocked, which is insecure.
- C: “Deny all” is a rule action, but “Implicit Deny” is the specific term for the default posture.
- D: “Implicit prevent all” is not standard terminology.
Q313 & Q314. For an anomaly-based IPS to function correctly/run optimally, what must be established first/determined?
- A. Signature Database
- B. Network Baseline ✓
- C. User Profiles
- D. Patch Levels
Why B is correct: Anomaly-based detection works by comparing current traffic against a “normal” baseline of network behavior. Without establishing this baseline first, the system cannot determine what constitutes an anomaly.
Why others are incorrect:
- A: Signature databases are used for signature-based IDS, not anomaly-based.
- C: User profiles are more relevant to identity management, not network traffic anomalies.
- D: Patch levels are important for security but do not define network traffic baselines.
Q315 & Q316. Which character is used in Snort rules to indicate “NOT”?
- A. #
- B. ! ✓
- C. $
- D. &
Why B is correct: In Snort rule syntax, the exclamation mark ! is used as a negation operator (e.g., !$HOME_NET means “not the home network”).
Why others are incorrect:
- A:
#is used for comments in Snort rules. - C:
$is used to denote variables (e.g.,$HOME_NET). - D:
&is not a standard Snort rule operator for negation.
Q317 & Q318. What is a unique identifier that is used in Snort?
- A. SID ✓
- B. ID
- C. PID
- D. NID
Why A is correct: SID stands for Snort ID (or Signature ID). Each Snort rule is assigned a unique SID to identify it specifically within the rule set.
Why others are incorrect:
- B: “ID” is too generic.
- C: PID stands for Process ID, used by operating systems.
- D: NID is not a standard Snort identifier term.
Q319 & Q320. Which rule type allows for logs and alerts in Snort? / Using Snort, which rule type allows for notification only if there is a match?
- A. Drop
- B. Alert ✓
- C. Pass
- D. Block
Why B is correct: The alert action in Snort generates an alert (using the configured alert method) and logs the packet when a rule matches.
Why others are incorrect:
- A:
dropblocks the packet and logs it (requires inline mode). - C:
passignores the packet and allows it without logging/alerting. - D:
blockis not a standard Snort rule action keyword (usuallydroporreject).
Q321 & Q322. In Snort, which part of the rule dictates the source, destination, rule type, and direction?
- A. Rule body
- B. Rule action
- C. Rule header ✓
- D. Rule connection
Why C is correct: The Snort rule header contains the action, protocol, source IP/port, direction operator, and destination IP/port. The body contains the options and content to match.
Why others are incorrect:
- A: The rule body contains the detection options (content, flags, etc.).
- B: The rule action is just one part of the header (e.g., alert, log).
- D: “Rule connection” is not a standard Snort rule component.
Q323 & Q324. What is one concern for using a SYN scan, even if you are going low and slow?
- A. Half-open connections. ✓
- B. It’s inaccurate.
- C. You are performing a full connect.
- D. Firewalls block all SYN messages.
Why A is correct: A SYN scan sends a SYN packet and waits for a SYN/ACK. If received, it sends a RST to tear down the connection without completing the handshake. This leaves “half-open” connections on the target for a brief period, which can be logged or detected by IDS.
Why others are incorrect:
- B: SYN scans are generally accurate for determining port state.
- C: A SYN scan is specifically a “half-open” scan, not a full connect (which is
-sT). - D: Firewalls do not block all SYN messages, or legitimate web browsing would fail.
Q325 & Q330. As an attacker, you are trying to prevent an IDS from alerting your presence… What is one method that may defeat the security policies set in place by the IDS and other security appliances?
- A. Firewalking
- B. Conducting a reverse shell exploit
- C. Session splicing ✓
- D. Using HTTP
Why C is correct: Session splicing (or session splitting) involves breaking the attack payload into small chunks across multiple packets. Older or poorly configured IDS may fail to reassemble the packets correctly to detect the signature, allowing the attack to pass.
Why others are incorrect:
- A: Firewalking is used to map firewall rules, not necessarily to evade IDS detection of payload.
- B: A reverse shell is a post-exploitation tool, not an evasion technique for the initial detection.
- D: Using HTTP is standard traffic; it doesn’t inherently evade IDS unless the payload within is obfuscated.
Q326, Q327, Q328, & Q329. What technique might you be able to use to get around older intrusion detection systems when sending traffic into a network? / Which technique helps evade older IDS systems by breaking packets into smaller pieces?
- A. Phishing
- B. Fragmentation ✓
- C. DNS Hijacking
- D. ARP Spoofing
Why B is correct: Packet fragmentation breaks a packet into smaller pieces. Older IDS systems might struggle to reassemble these fragments to inspect the full payload, allowing malicious content to slip through undetected.
Why others are incorrect:
- A: Phishing is a social engineering attack, not a network evasion technique.
- C: DNS Hijacking redirects traffic, it doesn’t necessarily evade IDS inspection of the traffic itself.
- D: ARP Spoofing is for intercepting traffic on a LAN, not evading IDS inspection of incoming traffic.
Q331 & Q332. Which of the following has the best chance of alerting on previously unknown attacks on a network?
- A. Signature-based IDS
- B. Packet-based IDS
- C. Behavior-based IDS ✓
- D. Rule-based IDS
Why C is correct: Behavior-based (or Anomaly-based) IDS establishes a baseline of normal traffic and alerts on deviations. This allows it to potentially detect new, unknown attacks (zero-days) that don’t match known signatures, provided the attack behavior deviates from the baseline.
Why others are incorrect:
- A: Signature-based IDS can only detect attacks that match known signatures in its database.
- B: Packet-based is a general term; without behavior analysis, it relies on signatures.
- D: Rule-based typically implies signature or policy rules, which require prior knowledge of the attack.
Q333. A traditional HIDS uses which method for detection?
- A. Signature base ✓
- B. Anomaly base
- C. Firewall rules
- D. Statistically anomaly
Why A is correct: Traditional Host-based Intrusion Detection Systems (HIDS) often rely on signature-based detection, comparing file integrity or log entries against a database of known malicious patterns.
Why others are incorrect:
- B: While some modern HIDS use anomaly detection, “traditional” HIDS are predominantly signature-based.
- C: Firewall rules are for network traffic filtering, not host-based detection.
- D: Statistical anomaly is a type of anomaly detection, less common in traditional HIDS compared to signatures.
Q334 & Q335. What must a signature-based IDS have in order to be effective?
- A. An up-to-date set of rules ✓
- B. A baseline
- C. Active rules
- D. Access to update user profiles
Why A is correct: Signature-based IDS relies on matching traffic against a database of known attack signatures (rules). If these rules are not updated, the IDS cannot detect new or variant attacks.
Why others are incorrect:
- B: A baseline is required for anomaly-based IDS, not signature-based.
- C: “Active rules” is vague; rules must be specific and up-to-date.
- D: User profiles are not the primary mechanism for signature-based network IDS.
Q336 & Q337. What would you use an intrusion detection system for?
- A. Blocking traffic
- B. Filtering traffic based on header information
- C. Generating alerts on traffic ✓
- D. Logging system messages
Why C is correct: The primary function of an IDS (Intrusion Detection System) is to monitor traffic and generate alerts when suspicious activity is detected. It typically does not block traffic (that is the role of an IPS).
Why others are incorrect:
- A: Blocking traffic is the function of an IPS or Firewall.
- B: Filtering based on headers is primarily a firewall function.
- D: Logging system messages is a function of Syslog or SIEM, though IDS logs alerts, its primary purpose is detection/alerting.
Q338 & Q339. What are the two types of intrusion detection systems?
- A. NIDS and SIDS
- B. HIDS and SIDS
- C. IDS and IPS
- D. HIDS and NIDS ✓
Why D is correct: The two main categories of IDS are Host-based (HIDS), which monitors a specific host, and Network-based (NIDS), which monitors network traffic.
Why others are incorrect:
- A: “SIDS” is not a standard acronym in this context.
- B: “SIDS” is not a standard acronym.
- C: IDS and IPS are different systems (Detection vs. Prevention), not types of IDS.
Q340 & Q341. Which of the following is considered a framework for penetration testing?
- A. Metasploit ✓
- B. Cain & Abel
- C. Nessus
- D. Security Onion
Why A is correct: Metasploit is a comprehensive penetration testing framework that provides tools for scanning, exploitation, post-exploitation, and payload generation.
Why others are incorrect:
- B: Cain & Abel is a password recovery/sniffing tool, not a full framework.
- C: Nessus is a vulnerability scanner.
- D: Security Onion is a Linux distribution for intrusion detection and log management.
Q342 & Q343. Which of the following tools is used exclusively to scan for vulnerabilities on a target system or a network?
- A. Snort
- B. Ncat
- C. Nessus ✓
- D. Metasploit
Why C is correct: Nessus is a dedicated vulnerability scanner designed specifically to identify security weaknesses and report on them.
Why others are incorrect:
- A: Snort is an IDS/IPS.
- B: Ncat is a networking utility for reading/writing data.
- D: Metasploit is an exploitation framework; while it has scanning modules, its primary purpose is exploitation, not exclusively scanning.
Q344 & Q345. What does a vulnerability scanner like Nessus not use to identify vulnerabilities?
- A. Exploited service ✓
- B. Banners
- C. Application headers
- D. Vulnerability signature
Why A is correct: Vulnerability scanners like Nessus identify potential vulnerabilities based on configurations, versions, and signatures. They do not typically exploit the service to confirm the vulnerability (that is the role of an exploitation framework like Metasploit), as exploitation could cause damage.
Why others are incorrect:
- B: Scanners use service banners to identify software versions.
- C: Scanners inspect headers for security misconfigurations.
- D: Scanners use vulnerability signatures to match against known issues.
Q346 & Q347. Which of the following is a good practice that includes the ability to isolate systems and detect attacks and may also include preventive measures?
- A. Defense in depth
- B. Security measure
- C. Baseline configuration
- D. Defensible network architecture ✓
Why D is correct: A defensible network architecture is designed specifically to make it easier to detect and isolate attackers (e.g., through segmentation, monitoring points) while incorporating preventive controls.
Why others are incorrect:
- A: Defense in depth is a strategy of layered controls, but “Defensible network architecture” is the specific term for the design practice described.
- B: “Security measure” is too generic.
- C: Baseline configuration is a hardening standard, not an architectural design.
Q348 & Q349. Which of these technologies would you use to remove malware in the network before it got to the endpoint?
- A. Antivirus
- B. Endpoint detection and response
- C. Stateful firewall
- D. Unified threat management device ✓
Why D is correct: A Unified Threat Management (UTM) device combines multiple security functions (Firewall, IPS, Antivirus, etc.) at the network perimeter, allowing it to scan and block malware before it reaches the endpoint.
Why others are incorrect:
- A: Antivirus runs on the endpoint, meaning the malware has already arrived.
- B: EDR runs on the endpoint.
- C: A stateful firewall tracks connections but typically doesn’t scan file contents for malware.
Q350. What tool could you safely use to perform dynamic analysis on a malware sample?
- A. strings
- B. Cuckoo Sandbox ✓
- C. Ollydbg
- D. Cutter
Why B is correct: Cuckoo Sandbox is an automated malware analysis system that runs samples in an isolated virtual environment. This allows analysts to observe the malware’s behavior (dynamic analysis) safely without infecting the host system.
Why others are incorrect:
- A:
stringsis a static analysis tool that extracts text from binaries. - C: Ollydbg is a debugger used for dynamic analysis but requires manual interaction and isn’t a sandboxed environment by default.
- D: Cutter is a reverse engineering platform, primarily for static analysis/debugging.
