IPS Flashcards
Explain Exploits and Anomalies
Exploits are known confirmed attacked and detectable by IPS, WAF, or AV. Anomalies are unknown, or zero-day like high CPU on a device.
What other features does the IPS engine help with (hint four answers)
App Control, and flow-based AV, Web filter, and email filter.
What are the two IPS databases?
Regular
Extended
When would you use the extended signature database?
When you have a high security environment, it may cause performance issues.
How can you handle a false positive outbreak of IPS signatures?
You can set the action to monitor while you investigate.
What is a signature exemption?
You can specify the ip addresses to exempt from the signature while investigating false-positives outbreaks.
Where are DoS policies processed?
They are processed early, in the kernel.
What are the tree types of DoS attacks?
TCP SYN flood
ICMP sweep
TCP port scan
What is a TCP SYN flood DoS?
Attacker floods victim with incomplete TCP/IP connection requests, victim’s connection table becomes full
What is an ICMP sweep?
Attacker sends ICMP traffic to find targets. Attacker can then attack hosts that reply
What is a TCP port Scan
Scans using TCP/IP request to varying destination ports. Identifies what ports are open.
What protocols can you configured for DoS Policy?
TCP, UDP, ICMP, STMP
What types of DoS can you configure in a DoS Policy?
Flood, sweep/scan, Source, destination
How can you determine thresholds for DoS?
If you are not sure what threshold to configure you could put the policy in monitor mode.
Should you turn on all IPS signatures?
No, you should start with the most business-critical services.
Do DoS policies need SSL Inspection mode?
No, it doesn’t look at the packet payload, just volume, source etc,
Does IPS require SSL inspection?
If you want to protect from attackers hiding attacks in encrypted environments.
What does set np-accel-mode basic do?
offloads IPS processing to NP
What does set cp-accel-mode basic do?
offloads basic IPS pattern matching to CP8 or CP9
What does set cp-accel-mode advanced do?
offloads more basic IPS pattern matching to CP8 or CP9 z
Which chipset uses Turbo to accelerate IPS sessions
SoC4
should IPS cause high CPU usage?
no, if it is you can use diagnose test application ipsmonitor
What does set fail-open enable do? (IPS)
traffic bypasses IPS inspection
What does set fail-open disabled do?
packets are dropped when the IPS socket buffer is full.
