23 Questions
What is the main functionality of TippingPoint Quarantine?
Blocking insider threats and walk-in worms
How does Quarantine work with the source IP address in the packets?
It adds the source IP to the Quarantine list
In what ways can Blocking Quarantine be used?
To prevent an infected machine from spreading worms or leaking confidential information
What does TippingPoint Quarantine communicate with switching infrastructures to do?
Isolate offending endpoints with remediation VLANs
How does Quarantine prevent network infection?
By extending protection down to the endpoint
What kind of information can Blocking Quarantine be used to inform the user about?
That something has gone wrong
What does Quarantine block to prevent the leaking of confidential information?
Spyware infection
Which part of the packets does Quarantine work with?
Source IP address
What is the primary function of Spyware Filters?
Immediately block malicious flow
When does Quarantine occur with regards to filter hits?
After excessive filter hits
What can be configured to take effect before the threshold is triggered?
Permit and trust actions
How are hosts released from Quarantine?
Redirect web requests to an external server
What is the purpose of configuring a threshold of permitted traffic?
Define the hit count within a certain period for Quarantine actions
What is the action taken when Trust actions are configured to take effect before the threshold is triggered?
Display a Quarantine web page to notify quarantined users
What occurs if Quarantine actions are configured at a user-defined threshold?
The quarantine actions occur when the defined threshold is reached
What is the purpose of setting thresholds to 1 and 1 for immediate block?
To block traffic immediately after the first hit meets the filter criteria
Where can you apply the newly created Quarantine action set?
Profiles > Shared Settings > Action Sets
What should be selected for the flow control when creating a new Quarantine action set?
Quarantine
In which table will a host appear if the Action Set is configured for Block + Quarantine and no threshold is set?
Quarantined Hosts table
What is the optional configuration for quarantine in the TSE settings?
Automatic timeout
Which type of traffic will the newly created Quarantine action set be used to test?
ICMP Echo Request (Ping) traffic
What is the main purpose of setting IPS Quarantine filters?
To apply quarantine to specific IP addresses
What happens if a threshold is not set and an Action Set is configured for Block + Quarantine?
A host will appear in the Quarantined Hosts table and a blocked stream will be generated.
Test your understanding of TippingPoint's quarantine functionality including concepts, considerations, and actions. Learn about blocking insider threats and walk-in worms, and how TippingPoint Quarantine communicates with switching infrastructures to isolate offending endpoints.
Make Your Own Quizzes and Flashcards
Convert your notes into interactive study material.
Get started for free
