712-50 Question 291
Single answerFirewall, IDS/IPS and Network Defense Systems (5 questions)A global company has deployed a next-generation firewall (NGFW) with integrated IDS/IPS at its internet edge. After enabling IPS signatures in blocking mode, the security operations team reports a sharp increase in blocked traffic, including legitimate customer sessions to the public web portal. The CIO is concerned about business disruption, while the CISO still wants stronger protection against active exploitation attempts. As the CCISO, which action is the MOST appropriate to reduce business risk while maintaining effective network defense?
- A
Disable IPS blocking entirely and run the system in detection-only mode until the next annual security architecture review
- B
Tune the IPS policy using risk-based signature selection, validate false positives from logs and packet captures, and deploy blocking first on high-confidence signatures while monitoring business impact
- C
Move all firewall and IPS rules to an implicit allow model so that customer traffic is less likely to be blocked
- D
Rely on endpoint antivirus to stop exploit attempts and reduce the edge firewall to basic network address translation only
Show answer and explanation
Correct answer: B
Explanation
The best answer is to tune and phase IPS enforcement rather than disabling protection or weakening the firewall posture. In practice, IDS/IPS and NGFW controls require continuous tuning because default signatures can generate false positives depending on business applications, custom protocols, and traffic patterns. A CCISO-level decision should balance confidentiality, integrity, and availability by preserving preventive controls where they provide high confidence and measurable value, while minimizing impact to customer-facing services. Industry best practices from major security frameworks and vendor deployment guidance consistently support a staged rollout: establish baselines, enable detection, validate alerts, tune exceptions carefully, then move selected signatures or categories into blocking mode. This approach also aligns with defense-in-depth and least privilege principles described in common security guidance such as NIST network security architecture and intrusion detection/prevention operational practices.
- A. Incorrect.
This is incorrect because completely disabling IPS blocking removes an important preventive control and leaves the organization relying only on alerting. While temporary detection-only operation can be appropriate during initial tuning or incident response, waiting until an annual review is too slow and does not reflect sound operational risk management for internet-facing systems.
- B. Correct.
This is correct because it balances security effectiveness with business continuity. A risk-based tuning approach focuses blocking on high-fidelity, high-severity signatures that are less likely to generate false positives, while validating alerts through log review and packet capture helps distinguish true attacks from legitimate traffic. This is consistent with best practices for IDS/IPS deployment: baseline normal traffic, tune signatures, use staged enforcement, and monitor operational impact before broadening prevention coverage.
- C. Incorrect.
This is incorrect because an implicit allow model weakens perimeter security and increases exposure. Firewalls should generally follow least privilege and default-deny principles, especially for internet-facing services. Changing the rule base to be broadly permissive may reduce blocking of legitimate traffic, but it also allows more malicious traffic and does not address the root cause of IPS false positives.
- D. Incorrect.
This is incorrect because endpoint antivirus is not a substitute for layered network defense. Many exploit attempts target public-facing applications and may never reach a managed endpoint in a way that antivirus can meaningfully prevent. Reducing the edge firewall to basic NAT removes critical controls such as application-aware filtering, segmentation enforcement, and intrusion prevention.