5.3.2 Review

It provides advanced features like intrusion prevention and deep packet inspection

It can only be used for monitoring network traffic

It does not require regular software updates

It is cheaper to implement than traditional firewalls

All traffic is allowed unless explicitly denied

It means that all traffic is blocked unless explicitly allowed by a rule

Traffic is allowed based on the time of day

Only outgoing traffic is monitored

Only allows traffic from known IP addresses

Intrusion detection and prevention capabilities

Is solely used for network performance monitoring

Requires manual updates for every rule

To increase the speed of network connections

To store data securely

To monitor and control incoming and outgoing network traffic based on predetermined security rules

To host web applications

Packet filtering firewall

Stateful inspection firewall

Application firewall

Network address translation (NAT) firewall

It offers better user interface options

It provides a dedicated hardware solution that can process and filter traffic more efficiently

It can only protect a single device

It is easier to configure than a software firewall

A VPN is installed on the hardware, while a firewall only exists as software

A VPN is used for local networks, a firewall is used for cloud networks

A VPN encrypts your internet traffic for secure remote access, while a firewall filters and controls incoming and outgoing network traffic.

A VPN prevents any traffic while a firewall allows all traffic

An IDS and IPS perform the same functions.

An IDS can block attacks while an IPS cannot.

An IPS only monitors network traffic without taking action.

An IDS monitors and alerts on suspicious activity while an IPS actively blocks it.

Only false positives with no true alerts.

Alerts for successful logins only.

Alerts based on detected anomalies and potential threats.

Only alerts for authenticated users.

An IPS is typically placed in-line with the network traffic it is protecting.

An IPS operates solely on endpoint devices.

An IPS is placed in a passive mode, like an IDS.

An IPS is usually located outside the firewall.

An IPS requires manual updates for every detected threat.

An IPS can drop malicious packets automatically before they reach their destination.

An IPS cannot distinguish between legitimate and malicious traffic.

An IPS only logs activity without any intervention.

An IDS requires that all network traffic be encrypted.

An IDS is often deployed in a passive mode to monitor network traffic without interfering with it.

An IDS operates only on specific endpoints.

An IDS is always deployed in-line to block traffic.

To log all network activity without taking action.

To actively prevent and block potential security threats in real-time.

To provide user authentication and access control.

To only alert administrators after an attack has occurred.

An IDS performs better when it is the only system in use.

Using both is redundant and unnecessary.

An IPS alone can detect threats more effectively than an IDS.

Combining both systems provides comprehensive security, with monitoring and threat prevention capabilities.

To provide traditional antivirus software

To integrate multiple security functions into a single device

To create isolated network segments

To monitor user behavior exclusively