200-301 Question 15
Select 2A company has implemented a next-generation firewall (NGFW) in their network to enhance security. The firewall administrator wants to ensure that the NGFW can detect and prevent intrusions in real-time while allowing legitimate traffic to pass. Which two features of the NGFW should the administrator enable to achieve this goal?
- A
Deep packet inspection (DPI)
- B
Signature-based intrusion detection
- C
Static packet filtering
- D
Application layer filtering
- E
Network Address Translation (NAT)
Show answer and explanation
Correct answers: A, B
Explanation
To achieve real-time intrusion detection and prevention, the administrator should enable features like deep packet inspection (DPI) and signature-based intrusion detection. DPI allows the NGFW to thoroughly analyze packets for anomalies, while signature-based detection identifies known threats. These combined capabilities ensure robust security while allowing legitimate traffic to flow.
- A. Correct.
Deep packet inspection (DPI) is a feature of NGFWs that examines the entire packet, including headers and payload, for malicious content or anomalies. This is essential for detecting advanced threats.
- B. Correct.
Signature-based intrusion detection allows the NGFW to identify known attack patterns and block them in real-time, helping to prevent intrusions.
- C. Incorrect.
Static packet filtering only examines packet headers and is unable to detect advanced attacks or payload-based threats, making it insufficient for real-time intrusion prevention.
- D. Incorrect.
Application layer filtering is useful for controlling application-level traffic but does not directly address intrusion detection or prevention.
- E. Incorrect.
Network Address Translation (NAT) is a routing feature that translates IP addresses but does not contribute to intrusion detection or prevention.