Exam 9: Firewalls and Intrusion Prevention Systems

__________ scans for attack signatures in the context of a traffic stream rather than individual packets.

The _________ defines the transport protocol.

A _________ firewall applies a set of rules to each incoming and outgoing IP packet and then forwards or discards the packet.

Unlike a firewall, an IPS does not block traffic.

A prime disadvantage of an application-level gateway is the additionalprocessing overhead on each connection.

The _________ is inserted between the premises network and the Internet to establish a controlled link and to erect an outer security wall or perimeter to protect the premises network from Internet-based attacks.

_________ matching scans incoming packets for specific byte sequences (the signature) stored in a database of known attacks.

The primary role of the personal firewall is to deny unauthorizedremote access to the computer.

A _________ consists of a set of computers that interconnect by means of a relatively unsecure network and makes use of encryption and special protocols to provide security.

A __________ firewall controls the traffic between a personal computer or workstation on one side and the Internet or enterprise network on the other side.

The firewall can protect against attacks that bypass the firewall.

A packet filtering firewall is typically configured to filter packets goingin both directions.

An important aspect of a distributed firewall configuration is securitymonitoring.

One disadvantage of a packet filtering firewall is its simplicity.

A single device that integrates a variety of approaches to dealing with network-based attacks is referred to as a __________ system.

The __________ protocol is an example of a circuit-level gateway implementation that is conceptually a "shim-layer" between the application layer and the transport layer and does not provide network-layer gateway services.

The firewall follows the classic military doctrine of _________ because it provides an additional layer of defense.

The firewall may be a single computer system or a set of two or moresystems that cooperate to perform the firewall function.

A ________ uses encryption and authentication in the lower protocol layers to provide a secure connection through an otherwise insecure network, typically the Internet.

Distributed firewalls protect against internal attacks and provideprotection tailored to specific machines and applications.