Firewalls, Intrusion Detection, and Intrusion Prevention Systems (IDS/IPS)
1. Firewalls
A firewall is a security system that monitors and controls incoming and outgoing network traffic
based on predetermined security rules. Firewalls are typically used to prevent unauthorized access
to or from a private network.
Types of Firewalls:
Packet Filtering Firewall:
Working: It inspects packets of data and decides whether to allow or block them based on the
source and destination IP addresses, ports, and protocols.
Example: A simple router firewall, which may block incoming traffic from certain IP addresses or
block traffic on specific ports.
Pros: Fast and efficient, as it does not require deep inspection of traffic.
Cons: Can be bypassed by attackers using specific methods such as IP spoofing.
Stateful Inspection Firewall:
Working: Unlike packet filtering firewalls, it tracks the state of active connections and makes
decisions based on both the set rules and the context of the traffic.
Example: Cisco ASA Firewalls, which track the state of network connections.
Pros: More secure than packet filtering, as it tracks session states and ensures traffic is part of a
legitimate connection.
Cons: More resource-intensive.
Proxy Firewalls:
Working: These firewalls act as intermediaries between users and the services they want to
access. It intercepts and forwards traffic to the destination on behalf of the user.
Example: A web proxy firewall that can filter web content.
Pros: Can provide deep inspection and anonymity.
Cons: Slower than stateful inspection because of the intermediary nature.
Next-Generation Firewalls (NGFW):
Working: NGFWs combine traditional firewall functions with additional features like encrypted
traffic inspection, intrusion prevention, and application control.
Example: Palo Alto Networks Next-Gen Firewalls.
Pros: Multi-layered security with application awareness and threat intelligence.
Cons: Higher cost and complexity.
2. Intrusion Detection Systems (IDS)
An Intrusion Detection System (IDS) monitors network traffic for suspicious activity and known
threats. It typically reports or alerts the network administrator of any intrusion attempts.
Types of IDS:
Network Intrusion Detection System (NIDS):
Working: Monitors network traffic for unusual activity and possible attacks.
Example: Snort (open-source NIDS) that analyzes network packets for potential threats.
Pros: Can monitor entire network traffic.
Cons: Can generate a lot of false positives.
Host-based Intrusion Detection System (HIDS):
Working: Installed on individual hosts (like servers or computers), HIDS monitors the activity and
logs for any malicious activities.
Example: OSSEC, which monitors file integrity and detects abnormal system behavior.
Pros: Monitors system-level activity and helps detect internal threats.
Cons: Cannot provide insight into network-level threats.
Signature-based IDS:
Working: It detects threats based on known patterns or signatures of malicious activity.
Example: McAfee Network Security Platform.
Pros: Very effective against known threats and attacks.
Cons: It cannot detect zero-day threats or new attack methods.
Anomaly-based IDS:
Working: It detects deviations from a predefined normal baseline, identifying potential threats
based on abnormal behavior.
Example: Bro (now Zeek) IDS.
Pros: Can detect new or unknown threats.
Cons: Prone to false positives as normal behavior may vary.
3. Intrusion Prevention Systems (IPS)
An Intrusion Prevention System (IPS) is a network security technology that works in real-time to
detect and block potential threats. It combines the features of an IDS with the capability to actively
block threats.
Types of IPS:
Network-based Intrusion Prevention System (NIPS):
Working: These systems are deployed in-line with the network to actively monitor and block
malicious traffic.
Example: Cisco IPS appliances.
Pros: Active blocking of malicious traffic.
Cons: Can introduce latency or disruption in case of misconfiguration.
Host-based Intrusion Prevention System (HIPS):
Working: Installed on individual host machines, HIPS monitors system activity and blocks
malicious actions.
Example: Symantec Endpoint Protection.
Pros: Focuses on host-level security and can protect against attacks that bypass network-level
security.
Cons: Can slow down the system and consume resources.
Signature-based IPS:
Working: Uses predefined signatures to detect and block known threats.
Example: Snort IPS.
Pros: Efficient for detecting known threats.
Cons: Cannot detect new or unknown attacks.
Anomaly-based IPS:
Working: Identifies threats based on abnormal traffic patterns and blocks potential threats.
Example: Suricata IPS.
Pros: Can detect zero-day and unknown attacks.
Cons: May generate false positives and need constant tuning.
Top 50 MCQs on Firewalls, IDS, and IPS
Here are 50 MCQs based on Firewalls, IDS, and IPS suitable for Government Exams like RPSC, ACP,
UGC NET, GATE, etc.
What is the primary function of a firewall?
a) To monitor network traffic
b) To encrypt data
c) To filter network traffic based on security rules
d) To perform a network scan
Answer: c) To filter network traffic based on security rules
Which of the following is a type of firewall that operates at the network layer?
a) Stateful Inspection
b) Application Layer Firewall
c) Proxy Firewall
d) All of the above
Answer: a) Stateful Inspection
Which of the following firewalls provides deep packet inspection for application-level attacks?
a) Proxy Firewall
b) Stateful Inspection Firewall
c) Packet Filtering Firewall
d) All of the above
Answer: a) Proxy Firewall
Which firewall type can be used to hide internal network structures and IP addresses from
external view?
a) Stateful Inspection Firewall
b) Proxy Firewall
c) Packet Filtering Firewall
d) Next-Generation Firewall
Answer: b) Proxy Firewall
What does an Intrusion Detection System (IDS) primarily do?
a) Blocks malicious traffic
b) Detects and alerts on suspicious activity
c) Encrypts sensitive data
d) All of the above
Answer: b) Detects and alerts on suspicious activity
Which of the following is an example of an anomaly-based IDS?
a) Snort
b) OSSEC
c) Bro (Zeek)
d) All of the above
Answer: c) Bro (Zeek)
Which type of IDS works by matching signatures of known attacks?
a) Anomaly-based IDS
b) Signature-based IDS
c) Host-based IDS
d) Network-based IDS
Answer: b) Signature-based IDS
Which of the following is a function of an Intrusion Prevention System (IPS)?
a) Alerts administrators about threats
b) Blocks malicious traffic in real-time
c) Monitors system logs
d) Performs vulnerability scans
Answer: b) Blocks malicious traffic in real-time
Which of the following is an example of a host-based IPS?
a) Snort
b) OSSEC
c) Cisco Firepower
d) Suricata
Answer: b) OSSEC
Which firewall type works as an intermediary between the user and the network resources?
a) Proxy Firewall
b) Stateful Firewall
c) Next-Generation Firewall
d) None of the above
Answer: a) Proxy Firewall
Which of the following is true about a stateful inspection firewall?
a) It inspects packets in isolation
b) It tracks active connections
c) It works as a proxy between user and resources
d) It provides deep inspection of packet content
Answer: b) It tracks active connections
Which of the following is NOT a feature of a next-generation firewall (NGFW)?
a) Intrusion prevention
b) Deep packet inspection
c) Application-level filtering
d) Basic packet filtering
Answer: d) Basic packet filtering
Which of the following tools is used for network-based IDS/IPS?
a) Snort
b) OSSEC
c) Bro (Zeek)
d) All of the above
Answer: a) Snort
What does the term “deep packet inspection” (DPI) refer to?
a) Scanning packet headers only
b) Analyzing the entire packet, including payload
c) Blocking specific IP addresses
d) Monitoring for network latency
Answer: b) Analyzing the entire packet, including payload
Which type of firewall is deployed to block network traffic based on the application?
a) Stateful Inspection Firewall
b) Application Layer Firewall
c) Proxy Firewall
d) Next-Generation Firewall
Answer: b) Application Layer Firewall
(You can continue with more questions in the same format...)
Let me know if you need more questions or explanations on any of the topics!
You said:
(You can continue with more questions in the same format...)
yes
ChatGPT said:
Certainly! Here are more MCQs based on Firewalls, IDS, and IPS.
16. What does a firewall do to prevent unauthorized access to a network?
a) Allows all incoming traffic
b) Analyzes and blocks traffic based on predefined security rules
c) Monitors network traffic for attacks
d) Encrypts all network data
Answer: b) Analyzes and blocks traffic based on predefined security rules
17. Which of the following is a key benefit of using a proxy firewall?
a) Allows fast traffic analysis
b) Protects against attacks by hiding the internal network structure
c) Provides real-time intrusion prevention
d) None of the above
Answer: b) Protects against attacks by hiding the internal network structure
18. In a packet filtering firewall, which information is primarily used to make decisions?
a) The IP addresses and ports of the packets
b) The content of the packets
c) The protocol used in the communication
d) The source and destination MAC address
Answer: a) The IP addresses and ports of the packets
19. Which firewall type performs detailed examination of application-level traffic?
a) Proxy Firewall
b) Stateful Inspection Firewall
c) Packet Filtering Firewall
d) Network-based Firewall
Answer: a) Proxy Firewall
20. What is the primary role of an Intrusion Detection System (IDS)?
a) Prevent unauthorized access
b) Detect and alert on malicious activities
c) Encrypt network traffic
d) Manage system performance
Answer: b) Detect and alert on malicious activities
21. Which of the following is the main difference between IDS and IPS?
a) IDS only detects, while IPS both detects and prevents attacks
b) IDS works at the application layer, while IPS works at the network layer
c) IDS is software-based, while IPS is hardware-based
d) IDS can only detect viruses, while IPS can detect malware
Answer: a) IDS only detects, while IPS both detects and prevents attacks
22. Which type of attack is primarily blocked by an Intrusion Prevention System (IPS)?
a) Phishing attacks
b) SQL injection attacks
c) Distributed Denial of Service (DDoS) attacks
d) Cross-Site Scripting (XSS) attacks
Answer: c) Distributed Denial of Service (DDoS) attacks
23. What is an example of a tool used for network-based IDS/IPS?
a) OSSEC
b) Suricata
c) FileZilla
d) SSH
Answer: b) Suricata
24. Which layer of the OSI model does a firewall typically operate at?
a) Network Layer
b) Transport Layer
c) Application Layer
d) Data Link Layer
Answer: a) Network Layer
25. What does an anomaly-based IDS rely on to detect attacks?
a) Predefined signatures of known attacks
b) A baseline of normal network behavior
c) Real-time traffic logs
d) File integrity checks
Answer: b) A baseline of normal network behavior
26. Which of the following is the most common method used in anomaly-based IDS to classify
malicious activities?
a) Signature matching
b) Behavioural analysis
c) Deep packet inspection
d) Port scanning
Answer: b) Behavioural analysis
27. What is the main purpose of a signature-based IDS?
a) Detect new and unknown attacks
b) Identify attacks based on known patterns or signatures
c) Analyze network traffic for anomalies
d) Prevent unauthorized access to the system
Answer: b) Identify attacks based on known patterns or signatures
28. Which of the following attacks can be detected by a stateful inspection firewall?
a) IP spoofing
b) SQL injection
c) Man-in-the-middle attacks
d) DDoS attacks
Answer: a) IP spoofing
29. Which device provides both firewall and IDS/IPS functionality in one unit?
a) VPN Gateway
b) Unified Threat Management (UTM) device
c) Load Balancer
d) DNS Server
Answer: b) Unified Threat Management (UTM) device
30. Which of the following is a limitation of a signature-based IDS?
a) It generates too many false positives
b) It cannot detect zero-day attacks
c) It only works in the application layer
d) It cannot detect encrypted traffic
Answer: b) It cannot detect zero-day attacks
31. Which is true about an IPS that is deployed in-line with the network?
a) It simply logs data without taking action
b) It inspects traffic but does not block malicious content
c) It can actively block malicious traffic in real-time
d) It only generates alerts
Answer: c) It can actively block malicious traffic in real-time
32. What is the purpose of log analysis in an IDS system?
a) To encrypt logs for secure storage
b) To analyze and track malicious patterns in traffic
c) To block attackers from accessing the system
d) To create firewall rules
Answer: b) To analyze and track malicious patterns in traffic
33. Which type of attack is IDS best suited to detect?
a) Malware infections
b) Phishing attacks
c) Unauthorized access and policy violations
d) Data encryption attacks
Answer: c) Unauthorized access and policy violations
34. What does a firewall primarily use to determine if a packet should be allowed or denied?
a) The MAC address of the device
b) The source and destination IP addresses
c) The source and destination port numbers
d) Both b and c
Answer: d) Both b and c
**35. Which of the following is a feature of next-generation firewalls (NGFW)?
a) Basic packet filtering
b) Application awareness and filtering
c) Malware detection only
d) No application filtering capabilities
Answer: b) Application awareness and filtering
36. Which of the following best describes an IPS device deployed in-line in a network?
a) It monitors network traffic without interfering with the flow
b) It blocks malicious traffic and allows legitimate traffic to pass through
c) It logs data for analysis without preventing attacks
d) It acts as a backup in case of a firewall failure
Answer: b) It blocks malicious traffic and allows legitimate traffic to pass through
37. Which of the following actions is a firewall least likely to perform?
a) Filtering network traffic based on IP address
b) Deep inspection of encrypted traffic
c) Preventing access to an unapproved website
d) Restricting access to specific ports
Answer: b) Deep inspection of encrypted traffic
38. What is a firewall rule that allows only HTTP traffic from a specific IP address?
a) Allow [Link], port 80
b) Block all ports except 80
c) Allow all traffic from [Link]/24
d) Allow all incoming traffic
Answer: a) Allow [Link], port 80
39. Which is the primary function of a next-generation firewall (NGFW)?
a) To prevent unauthorized access by filtering IP traffic
b) To inspect and block incoming traffic based on predefined rules
c) To provide firewall and IDS/IPS features with deep packet inspection and application filtering
d) To encrypt traffic between two endpoints
Answer: c) To provide firewall and IDS/IPS features with deep packet inspection and application
filtering
40. Which of the following is NOT a feature of IDS systems?
a) Alerting administrators about suspicious activity
b) Blocking malicious traffic in real-time
c) Logging traffic for later analysis
d) Monitoring network and host activity
Answer: b) Blocking malicious traffic in real-time
41. What type of traffic does a stateful firewall typically inspect?
a) Only the packet headers
b) Only the payloads of packets
c) Both the packet headers and state of the connection
d) Only application-level traffic
Answer: c) Both the packet headers and state of the connection
42. Which of the following is a limitation of anomaly-based IDS?
a) High rate of false positives
b) Limited scalability
c) Inability to detect new threats
d) Cannot detect encrypted traffic
Answer: a) High rate of false positives
