Skip to content

CS KAIROS · LEARNING LIBRARY

M12 · Evading IDS, Firewalls, and Honeypots · Q&A

Check understanding with original scenarios and a reason for every option. These answers do not establish exam or practical readiness.

Scenario questions

ceh-m12-controls-q1 · Original practice

What can first be said when an IDS shows no alert?

JavaScript is off: read the answer and explanation

C

No alert does not establish absence.
IDS alerting and blocking are distinct.
This preserves the observation and unresolved conditions.
It also does not establish compromise.

ceh-m12-controls-q2 · Original practice

Why include legitimate traffic in firewall testing?

JavaScript is off: read the answer and explanation

A

Controls need to satisfy protection and functional requirements.
Legitimate cases do not change deny policy.
Denial and observation cases still need testing.
Systems can log denials depending on configuration.

Continue to safe practice →