Flashcards
Firewalls, IDS, and IPS
Cards in this deck (13)
- 1What are the main types of firewalls?Packet filters, circuit-level gateways, stateful inspection, and application-level (Layer-7) firewalls.
- 2At which OSI layers do packet filter firewalls operate?Back: Layers 3 (Network) and 4 (Transport).
- 3What is the primary function of a circuit-level gateway?To act as a middleman between systems, facilitating communication by potentially changing IP addresses and port numbers, foundational to NAT and PAT.
- 4How does stateful inspection enhance firewall functionality?By tracking the state of active connections, allowing dynamic rule creation to permit response traffic, thereby simplifying rule management.
- 5What distinguishes application-level firewalls from packet filters?Application-level firewalls can inspect the contents (payload) of packets, not just headers, offering deeper security by analyzing application data.
- 6What feature is common to all firewalls?The use of rules to define whether traffic will be permitted or denied.
- 7How do firewalls contribute to network security?By intercepting and inspecting traffic, enforcing policies, and preventing unauthorized access.
- 8What is the OSI model, and why is it important for understanding firewalls?The Open Systems Interconnection model is a conceptual framework used to understand network interactions across seven layers, important for designing and implementing firewall rules and policies.
- 9Describe how data flows across the OSI model layers in the context of firewalls.Firewalls filter traffic based on OSI layers, such as IP addresses and ports at the Network and Transport layers (3 and 4), and can inspect application data at the Application layer (Layer 7).
- 10What is the difference between IDS and IPS?IDS detects and alerts on malicious traffic, whereas IPS blocks threats by intercepting them.
- 11How do IDS and IPS devices operate in tap mode?In tap mode, they monitor network traffic passively, ideal for IDS. IPS requires in-line mode to actively block threats.
- 12What is in-line mode for IPS devices?IPS is placed directly in the traffic stream to inspect and block malicious packets, acting as an invisible bridge while monitoring traffic.
- 13How do reputation-based protections work in IPS devices?Blocks traffic, especially files known to carry viruses or malware, based on the file's history of being a threat.
Information
- Description
- GRE NetSec Foundations Flashcards on Firewalls, IDS, and IPS, created by Joseph Rubino on 05/03/2024.
- Created by
- Joseph Rubino
- Views
- 1
- Rating