Evading IDS, Firewalls and Honeypots Quiz

Q1. Deception technology extends the honeypot idea by:

Replacing the firewall Placing decoy assets and credentials throughout the production environment Encrypting endpoints Blocking traffic

Q2. A network-based IDS typically:

Only manages passwords Runs in promiscuous mode and monitors network traffic Only blocks DNS Only audits one file

Q3. A true positive IDS alert means:

An attack occurred but was missed A legitimate attack was detected No attack occurred The IDS was offline

Q4. A circuit-level gateway monitors:

DNS ownership Keyboard input Requests to create sessions Individual files

Q5. The main limitation of an IDS deployed on a SPAN port is that it:

Cannot read TCP Can drop packets under heavy load and cannot block traffic Requires TLS keys Only sees broadcast

Q6. A honeytoken is:

An encryption key A hardware key A fake credential or record that should never be used legitimately A firewall rule

Q7. A reverse shell over DNS is chosen when:

TLS is blocked The IDS is offline Only DNS resolution is permitted outbound The target has no disk

Q8. A honeypot is:

A password manager A firewall rule A production database A decoy system used to detect and study attackers

Q9. Alert fatigue is a security problem because:

It breaks signatures It uses disk space It slows the network Genuine detections get lost among false positives

Q10. A hardware firewall is:

A user account A dedicated standalone device A browser extension A text file

Q11. Why should a tester agree with the client whether evasion is in scope?

Evasion tests the defenders, and the client may want detection measured instead It costs more Tools are unreliable It is illegal

Q12. Attackers detect honeypots by looking for:

TLS certificates High bandwidth Open ports Unrealistic configuration, missing user activity and virtualisation artefacts

Q13. WAF bypass frequently succeeds by:

Using a different port Changing the user agent Sending more requests Finding an encoding or syntax variant the rule set does not cover

Q14. Egress filtering is valuable because it:

Encrypts traffic Speeds up browsing Blocks inbound scans Restricts outbound connections, hindering C2 and exfiltration

Q15. Domain fronting was used to evade filtering by:

Encrypting DNS Compressing requests Using IPv6 Making the visible TLS destination differ from the actual host requested