200-301 Question 14
Single answerA company has recently deployed a next-generation firewall (NGFW) to enhance its network security. During an incident investigation, the IT team notices that malicious traffic was not blocked even though the firewall is configured correctly. The team later discovers that the intrusion prevention system (IPS) of the NGFW was not functioning as expected. What could be the reason for this issue?
- A
The firewall rules are not configured to inspect encrypted traffic.
- B
The IPS signatures database is outdated.
- C
The NGFW is operating in a passive mode.
- D
The network lacks a default route for outbound traffic.
Show answer and explanation
Correct answer: B
Explanation
Next-generation firewalls integrate traditional firewall capabilities with additional features like intrusion prevention systems (IPS). The IPS relies on updated threat signatures to detect and block malicious activity. If the IPS database is outdated, it will fail to identify new threats, leading to the issue described in the scenario. Regular updates to the IPS signatures are essential for maintaining effective network security.
- A. Incorrect.
Encrypted traffic inspection is crucial for detecting threats within encrypted sessions, but this is not directly related to the IPS functionality failure described in the scenario.
- B. Correct.
An outdated IPS signatures database prevents the NGFW from identifying and blocking the latest threats, which aligns with the issue described in the scenario.
- C. Incorrect.
If the NGFW is in a passive mode, it could monitor traffic but would not actively block malicious traffic. However, the scenario specifies that the NGFW is configured correctly, so this is less likely the cause.
- D. Incorrect.
A lack of a default route affects traffic routing but is unrelated to the IPS not functioning as expected.