D488-CASP (Mark Birch book) Study
Guide with Correct Answers 2026
Updated.
De-primeterization - Answer Access to information systems may be made from devices
outside of the enterprise network.
Example: Smart phone used to access an IOT device transmitting telemetry data.
Regulatory or industry compliance in regards to the network segmentation forces what
separation - Answer Business Units and Processes
What is DID? - Answer Defense in Depth! Having multiple layers of security on a network so
some layer catches on to the attack
What is the OSI model? - Answer - Physical layer 1
- Data link layer 2
- Network Layer 3
- Transport Layer 4
- Session Layer 5
- Presentation Layer 6
- Application Layer 7
What is UTM? - Answer Unified threat management- offers firewall functionality and many
additional security functions; it is deployed as a single security appliance or software solution
DOESNOT OFFER DiD(requirement for enterprise) This can still work for small enterprises
What are the security features of UTM? - Answer -Network Firewall
-IDS
-IPS
-Deep packet inspection(DPI)
-Anti Virus capability
-Web application fire wall(WAF)
-Web proxy and content filtering
-Spam filtering
,-SIEM
What are Adv/DisAdv to UTM? - Answer +Reduction in management actions
+Reduced foot print in the data center
+Less cost
-Risk of SPOF
-Negative Performance due to workload
What is the most commonly adopted ids/ips? - Answer NIPS (especially for enterprise)
In general ips/ids help stop attackers while they are gathering information
What are the two main techniques that are routinely used to detect incidents? - Answer
Signature based detection: compares know signatures against network events.(events written
by vendor or operator)
Ex:Rule set in place to restrict root login OR
Email with the subject password reset with passrgen.exe attached.
Anomaly based detection: compares what is considered normal with observed events to
identify significant deviations.(great for unknown threats)
Ex: the smtp server normal contributes to 23% of traffic and it bumps up to 70
What is the difference between NIPS AND NIDS? - Answer NIPS: sits behind a firewall and
traffic needs to be forwarded on to the network CAN BLOCK: unwanted traffic and Payloads
What does in-line mean? - Answer It means the device is directly behind the firewall and
traffic needs to be forwarded
Does a network IDS need to be inline? - Answer No it can monitor traffic but will need to use
port mirroring or spanning on the network switch to be effective
What is a wireless IPS? - Answer Designed to detect the use of rogue or misconfigured
wireless devices. Can build up a database of known trusted hosts on the network and can also
be used to prevent DoS attacks
, Rogue meaning a device that can spoof a MAC address of a trusted device.
An effective WIPS should mitigate what type of threats? - Answer -Ad hoc networks: P2P
connections
-Rogue access points: Attackers that bypass perimeter security
-Evil-Twin APs: Users that's may connect to a lookalike network and be vulnerable to sniffing
-Misconfigured APs: configuration errors
-Client misassociation
-MITM attack
-MAC Spoofing
-DoS attack
What is HAIPE-IS? - Answer High Assurance Internet Protocol Encryptor Interoperability
Specification
REQUIRES: inline network encryption (INE)
What is an example of INE? - Answer Tactical Local Area Network Encryptor (TACLANE)
Military grade meets NSAs security requirements
What is NAC? - Answer Network Access Control (NAC) enforces a strong secure posture for
devices
MAJOR CHALLENGE: BYOD
GOAL: make sure access is controlled, devices have anti virus, and a firewall
EXPECTATION: users connect via VLAN using a captive portal ( think segmentation)
What is a SIEM? - Answer Allows an organization to centralize security management events.
Provides correlation and normalization for context and alerting and also provides reporting and
alerts based on real data inputs.
Guide with Correct Answers 2026
Updated.
De-primeterization - Answer Access to information systems may be made from devices
outside of the enterprise network.
Example: Smart phone used to access an IOT device transmitting telemetry data.
Regulatory or industry compliance in regards to the network segmentation forces what
separation - Answer Business Units and Processes
What is DID? - Answer Defense in Depth! Having multiple layers of security on a network so
some layer catches on to the attack
What is the OSI model? - Answer - Physical layer 1
- Data link layer 2
- Network Layer 3
- Transport Layer 4
- Session Layer 5
- Presentation Layer 6
- Application Layer 7
What is UTM? - Answer Unified threat management- offers firewall functionality and many
additional security functions; it is deployed as a single security appliance or software solution
DOESNOT OFFER DiD(requirement for enterprise) This can still work for small enterprises
What are the security features of UTM? - Answer -Network Firewall
-IDS
-IPS
-Deep packet inspection(DPI)
-Anti Virus capability
-Web application fire wall(WAF)
-Web proxy and content filtering
-Spam filtering
,-SIEM
What are Adv/DisAdv to UTM? - Answer +Reduction in management actions
+Reduced foot print in the data center
+Less cost
-Risk of SPOF
-Negative Performance due to workload
What is the most commonly adopted ids/ips? - Answer NIPS (especially for enterprise)
In general ips/ids help stop attackers while they are gathering information
What are the two main techniques that are routinely used to detect incidents? - Answer
Signature based detection: compares know signatures against network events.(events written
by vendor or operator)
Ex:Rule set in place to restrict root login OR
Email with the subject password reset with passrgen.exe attached.
Anomaly based detection: compares what is considered normal with observed events to
identify significant deviations.(great for unknown threats)
Ex: the smtp server normal contributes to 23% of traffic and it bumps up to 70
What is the difference between NIPS AND NIDS? - Answer NIPS: sits behind a firewall and
traffic needs to be forwarded on to the network CAN BLOCK: unwanted traffic and Payloads
What does in-line mean? - Answer It means the device is directly behind the firewall and
traffic needs to be forwarded
Does a network IDS need to be inline? - Answer No it can monitor traffic but will need to use
port mirroring or spanning on the network switch to be effective
What is a wireless IPS? - Answer Designed to detect the use of rogue or misconfigured
wireless devices. Can build up a database of known trusted hosts on the network and can also
be used to prevent DoS attacks
, Rogue meaning a device that can spoof a MAC address of a trusted device.
An effective WIPS should mitigate what type of threats? - Answer -Ad hoc networks: P2P
connections
-Rogue access points: Attackers that bypass perimeter security
-Evil-Twin APs: Users that's may connect to a lookalike network and be vulnerable to sniffing
-Misconfigured APs: configuration errors
-Client misassociation
-MITM attack
-MAC Spoofing
-DoS attack
What is HAIPE-IS? - Answer High Assurance Internet Protocol Encryptor Interoperability
Specification
REQUIRES: inline network encryption (INE)
What is an example of INE? - Answer Tactical Local Area Network Encryptor (TACLANE)
Military grade meets NSAs security requirements
What is NAC? - Answer Network Access Control (NAC) enforces a strong secure posture for
devices
MAJOR CHALLENGE: BYOD
GOAL: make sure access is controlled, devices have anti virus, and a firewall
EXPECTATION: users connect via VLAN using a captive portal ( think segmentation)
What is a SIEM? - Answer Allows an organization to centralize security management events.
Provides correlation and normalization for context and alerting and also provides reporting and
alerts based on real data inputs.
