Intrusion Prevention Systems (IPS)

How does a network-based IPS primarily operate regarding traffic analysis?

Which statement accurately differentiates between IDS and IPS technologies?

What is a primary disadvantage of host-based IPS (HIPS) compared to network-based IPS?

What is the key characteristic of a 'zero-day' attack that makes it particularly challenging to defend against?

An administrator notices numerous false positive alarms on the IPS. What action should the administrator take to address this issue?

Which type of IPS signature examines multiple packets over time to identify malicious activity?

What is the purpose of using SPAN (Switched Port Analyzer) in network monitoring?

When evaluating different vendor IPS solutions, which factor is the MOST important to consider alongside the security budget?

What is a potential disadvantage of using anomaly-based detection in an IPS?

In the context of IPS actions, what does 'Request Block Connection' typically accomplish?

IDS operates in inline mode, actively blocking malicious traffic as it passes through the network.

A key advantage of an IDS is that its deployment typically has a direct impact on network performance, ensuring thorough inspection of all traffic.

A zero-day attack refers to an exploit that leverages a vulnerability known by both the vendor and the security community, allowing quick patching.

Cisco SPAN (Switched Port Analyzer) is used to mirror network traffic from one or more ports to a dedicated port for analysis by an IDS or IPS system.

Network-based IPS can effectively examine encrypted traffic without requiring decryption, providing visibility into potential threats within secure communications.

A signature in IPS is a single, unchangeable attribute.

Atomic signatures in IPS are designed to detect patterns across multiple network packets, offering a comprehensive view of potential threats.

In IPS, a 'false negative' alarm indicates that an attack occurred, and the IPS correctly generated an alarm.

The primary goal of 'request block host' action in IPS is to permit traffic based on configured exceptions.

Security budget has no impact on the selection and deployment of IPS sensors.

What is the primary goal of endpoint security in a borderless network environment?

Which technology provides features such as spam filtering and outbound message control?

How does deploying multiple security technologies enhance Endpoint Security?

Which Layer 2 attack involves an attacker flooding the switch's MAC address table with bogus MAC addresses?

Why is it important to configure port security on a switch?

Which port security violation mode drops traffic from unauthorized MAC addresses and increments the violation counter?

What is the primary purpose of DHCP snooping?

In a network with DHCP snooping enabled, how are ports typically configured to differentiate between legitimate and potentially malicious DHCP traffic?

What type of Layer 2 attack involves an attacker overwhelming a DHCP server by sending numerous requests for IP addresses, exhausting the available address pool?

Which action does Cisco's AMP (Advanced Malware Protection) take before a potential malware attack?

Cisco AMP focuses on security measures applied before, during, and after a malware attack.

In a CAM table overflow attack, macof is used to flood a switch with legitimate MAC addresses, overwhelming the switch's memory.

Implementing DHCP snooping involves configuring switch ports as either 'trusted' or 'protected' to filter DHCP traffic.

Cisco Email Security solutions offer solely spam blocking and inbound message control.

Host-based protection methods include antivirus/antimalware, spam filtering and URL filtering.

In port security, 'Protect' violation mode increases the violation counter, sends a syslog message, and shuts down the port.

NAC authenticates users and enforces network security policies, but does not assess endpoint compliance.

Traditional endpoint security primarily relies on perimeter firewalls and network intrusion prevention systems.

A DHCP starvation attack occurs when a rogue DHCP server provides incorrect IP configuration information to clients.

Layer 3 vulnerabilities are mitigated using ethernet frames and MAC address filtering.