Lesson 09 - Group 3: Network Security Capability Enhancement

Network ACL

A list of permissions associated with a router, switch, or network interface that controls network traffic.

Firewall rule

A rule that controls inbound or outbound traffic based on IP addresses, IP ranges, or network interfaces.

Screened subnet

A neutral network zone separating public-facing servers from sensitive internal resources.

What are the two IDS and IPS deployment types listed?

Host-based and network-based.

What is the shared purpose of IDS and IPS technologies?

To identify suspicious patterns or activities that may indicate a network or system intrusion.

What IDS and IPS tools are listed in Lesson 9?

Snort, Suricata, and OSSEC.

Signature-based detection

Detects suspicious activity by matching it against known patterns or signatures.

Anomaly-based detection

Detects activity that differs from an established normal pattern.

Trend analysis

Examines activity over time to identify meaningful changes or patterns.

Behavioral-based detection

Evaluates the behavior of networks, users, or entities to identify suspicious activity.

NBAD

Network Behavior and Anomaly Detection.

UEBA

User and Entity Behavior Analytics.

What is the primary purpose of web filtering?

To block malicious or inappropriate websites, enforce acceptable-use requirements, and reduce malware and phishing exposure.

What web-filtering methods are listed?

Agent-based filtering, centralized filtering, URL scanning, content categorization, block rules, and reputation-based filtering.

Why may HTTPS traffic be decrypted and inspected?

To allow security tools to examine encrypted web traffic for prohibited or malicious conten