3

I am studying Security Fundamentals on Networks and as a part of an excercise I have the following question:

Which of the following statements are true? (Select all that apply)

a.- An IDS deals with malicious traffic that the firewall missed.

b.- An IPS is on the boundary of the trusted inside and the untrusted outside.

c.- A network-based firewall protects hosts from malicious traffic originating on their same network.

d.- An IPS protects hosts from malicious traffic originating on their same network.

What could be the answers? According to me, b and c would be the answers because an IPS protects the original traffic that pass through, b because it is in the boundary but I have a doubt with option a because and IDS as I know makes a copy of the traffic just to analyze it.

  • IDS is a detection system whereas IPS the prevention system. B should had been the most accurate answer. However, I leave the community to decide that. – Shritam Bhowmick May 6 '17 at 0:51
  • @ShritamBhowmick It's multiple-choice. – Arminius May 6 '17 at 0:52
  • @Arminius yes multiple choice but isn't A more about detection at the first network layer. Not sure, hence never answered. – Shritam Bhowmick May 6 '17 at 0:54
  • A depends on what "deals with" is intended to mean exactly. – mad_manny Sep 4 '17 at 12:55
5

First of all, let's look at definitions for IPS and IDS:

IDS:

An intrusion detection system (IDS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any detected activity or violation is typically reported either to an administrator or collected centrally using a security information and event management (SIEM) system.

IPS

Intrusion prevention systems (IPS) [...] are network security appliances that monitor network or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, report it and attempt to block or stop it.

Intrusion prevention systems are considered extensions of intrusion detection systems because they both monitor network traffic and/or system activities for malicious activity. The main differences are, unlike [IDS], [IPS] are placed in-line and are able to actively prevent or block intrusions that are detected. IPS can take such actions as sending an alarm, dropping detected malicious packets, resetting a connection or blocking traffic from the offending IP address.

(Emphasis mine.)

Now let's look at the question and the given answers:

Which of the following statements are true? (Select all that apply)

a.- An IDS deals with malicious traffic that the firewall missed.

As we just learned, an IDS is only used for monitoring and not for "dealing with" (whatever that means exactly). It is fair to say that IDS is not actively involved in blocking or filtering such traffic, so "dealing with" is probably: FALSE.

As Georgios pointed out, "dealing with" could also be interpreted less actively, so this might be TRUE. English is not my first language, so other comments are welcome.

b.- An IPS is on the boundary of the trusted inside and the untrusted outside.

I wouldn't say so, but you could argue it that way. Typically the IPS sits behind the boundary - this is where the firewall would be - to lower the load of traffic the IPS has to analyze. The firewall filters out most of the easy-to-detect unwanted traffic, the IPS takes care of the more sophisticated stuff.

In my view: FALSE.

c.- A network-based firewall protects hosts from malicious traffic originating on their same network.

Nope. A network-based firewall protects hosts inside a network from malicious traffic that originates from the internet or any other network that sends traffic to these hosts. A host-based firewall protects a host (if set up correctly) from all sorts of traffic, irrelevant where it comes from. This would be a software that is installed on a machine, like Windows firewall.

FALSE.

d.- An IPS protects hosts from malicious traffic originating on their same network.

Helloooo, there it is. This is a correct statement. BUT, an IPS does more than that. See (at least) wikipedia article for more information on that.

TRUE.

  • 4
    As usual, these certification questions play with the language... If the phrase "it deals with" is not interpreted only as "actively intercepts"/"stops" the malicious traffic but also as "monitors"/"reports on" the malicious traffic (like "deals with"="has to do with"), then (a) could also be considered as true. – George Sep 4 '17 at 15:40
  • 2
    The problem is, that one is never sure if the examiner is probing the candidates language skills or has exceeded the limit of their own. :) – symcbean Sep 4 '17 at 15:51
0

I would say
A False, as IDS only notifies and does not prevent intrusion. So the missed traffic will pass.
B TRUE
C False as network-based firewall will inspect all packets that are originating from both the local and outside networks. (in case they pass the firewall)
D False, the same as C.

  • "notifying" is "dealing with" ? - IPS isn't within the network protecting trusted computer to trusted computer intrusion? – schroeder May 7 '17 at 14:32
0

The correct answer should be A and D option.

a.- An IDS deals with malicious traffic that the firewall missed.

b.- An IPS is on the boundary of the trusted inside and the untrusted outside.

c.- A network-based firewall protects hosts from malicious traffic originating on their same network.

d.- An IPS protects hosts from malicious traffic originating on their same network.

-1

Remember the difference between IDS and IPS. Detection and Prevention. Wjile IDS may run on a host and can detect attacks it has no way to prevent them. Since a IPS is on the firewall it can see and stop all malicious traffic.

A, True, since it may be implemented on the hosts (HIDS)

B, True, an IPS must be able to stop malicious traffic

C, False, a firewall is not inspecting packets on the same network

D, False, for the same reason as B

  • how can B and D be different if they are the same? – schroeder May 7 '17 at 10:04
  • B. It is supposed to stop malicious traffic but is not put on the boundary, but rather after the firewall. So FALSE. D. Here the "same network" is not "the same LAN" but rather the internal network of the organization. An IPS does exactly this job as well: inspecting and stopping malicious traffic running in internal network, so TRUE – George Sep 4 '17 at 15:48
-1

My Answer is:

A - True - traffic that evades the firewalls will be deal with IDS and IPS.

B - False- A Firewall sits on the border between the trusted inside and the untrusted outside.

C - True - A network vulnerable to malicious traffic originating from that very network.

D - True - IPS as a control device is in-line, so original traffic must pass through the IPS.

  • IPS can't sit on the border? – schroeder May 7 '17 at 10:05
  • No, it cannot. You need first a more throughout cleanup of the traffic (at the level of IP addresses, TCP/UDP ports) and only then the specialized inspection of the packet payload that the IPS/IDS offer. – George Sep 4 '17 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.