Security Operations · Topic 3 of 14
Intrusion Prevention, Firewalls and Content Filters
Security+ network controls: NIDS, NIPS, HIDS, HIPS and WIPS, firewall rules, WAF, UTM, Layer 4 and Layer 7, rate limiting, DLP and content filters.
- 5 min
- IDS detects and alerts. IPS sits inline and blocks.
- NIDS and NIPS watch the network, HIDS and HIPS watch one host, and WIPS watches the wireless space.
- Signature detection needs updates. Anomaly detection compares with a baseline.
What it is
Network security capabilities are the tools that inspect, allow, block and filter traffic. This page covers intrusion detection and prevention systems, firewalls of several kinds, and content filters.
The exam gives a problem, such as a flood of login attempts or a rogue access point, and asks which tool or setting fixes it.
How it works
Intrusion detection and prevention
An intrusion detection system (IDS) watches traffic or activity and alerts on suspicious patterns. An intrusion prevention system (IPS) sits inline and can block the traffic as well.
| Type | Where it works | What it sees |
|---|---|---|
| Network-based IDS (NIDS) and network-based IPS (NIPS) | On a network segment | Traffic between many hosts |
| Host-based IDS (HIDS) and host-based IPS (HIPS) | Software on one device | Processes, files, logs and traffic of that host |
| Wireless intrusion prevention system (WIPS) | Sensors in the wireless space | Rogue access points, evil twins and wireless attacks |
Detection uses signatures, which match known attack patterns, and anomaly or behavior detection, which compares activity with a normal baseline. Signatures need regular updates to catch new threats.
A NIDS usually receives a copy of traffic, so it cannot stop an attack by itself. A NIPS is inline, so a failure or a false positive can block legitimate traffic. A HIDS or HIPS can see traffic after it is decrypted on the host, which a network sensor cannot.
A WIPS can find an access point that someone plugged into the network without approval, then alert and try to contain it.
Firewalls
A firewall allows or blocks traffic by rules. Each rule lists a source, a destination, a port or protocol, and an action.
| Feature | Meaning |
|---|---|
| Rule-based | Rules are checked in order, the first match wins, and the list ends with an implicit or explicit deny |
| Layer 4 | Decisions use addresses, ports and the transport protocol, such as the Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) |
| Layer 7 | Decisions use the application data, such as the website, application or command inside the traffic |
| Web application firewall (WAF) | Protects a web application by inspecting Hypertext Transfer Protocol (HTTP) requests for attacks such as SQL injection and cross-site scripting |
| Unified threat management (UTM) | One appliance that combines firewall, intrusion prevention, malware scanning, content filtering and often a virtual private network (VPN) |
| Rate-limiting requests | Limits how many requests a client may send in a period, which slows brute force, scraping and some denial of service attempts |
More specific rules go above general ones, since a broad allow rule placed first would match before a specific deny. Remove rules that are no longer used and review the rule set regularly.
A Layer 4 firewall can allow port 443 but cannot tell which website is inside the encrypted session. A Layer 7 firewall can tell one application from another on the same port, often with TLS inspection.
UTM is simple to manage and suits smaller sites, but it is a single point of failure and can slow down when every feature is turned on.
Content filters
A content filter controls what users may reach or send, by category, address, reputation or content.
| Approach | How it works |
|---|---|
| Agent-based | Software on the device applies the policy wherever the device is, including at home |
| Centralized proxy | Traffic is sent through a proxy that applies the policy for everyone behind it |
| Data loss prevention (DLP) | Inspects outgoing content and blocks or alerts when sensitive data, such as card numbers, is found |
Category filtering lets an organization block groups of sites, such as malware or gambling. A centralized proxy is easy to manage but only covers traffic that passes through it. An agent follows the device off the network.
How the exam asks about this
- "A website receives thousands of login attempts per minute from a few addresses." -> Rate-limiting requests, often on a WAF.
- "A device that inspects HTTP traffic to stop SQL injection against a web app." -> A web application firewall.
- "Laptops must be filtered when staff work from home." -> An agent-based content filter.
What to remember for the exam
- IDS detects and alerts. IPS sits inline and blocks.
- NIDS and NIPS watch the network, HIDS and HIPS watch one host, and WIPS watches the wireless space.
- Signature detection needs updates. Anomaly detection compares with a baseline.
- Firewall rules are read in order and end with a default deny.
- Layer 4 firewalls use addresses and ports. Layer 7 firewalls understand the application.
- A WAF protects web applications from attacks in HTTP requests.
- UTM combines many functions in one appliance.
- Rate limiting slows brute force and request floods.
- Content filtering can be agent-based or through a centralized proxy, and DLP stops sensitive data leaving.
When a question names a rogue access point or evil twin and asks for a tool that detects it, the answer is a WIPS.
Common mistakes
Putting a broad allow rule above a specific deny. The broad rule matches first, so the deny never applies.
Expecting a NIDS to block traffic. Detection systems alert. Only an inline prevention system blocks.
Choosing a network firewall for web app attacks. A Layer 4 firewall allows port 443 traffic without looking at the request, so a WAF is needed.
Believing a proxy filters traffic everywhere. It only covers traffic sent through it, while an agent follows the device.
Treating UTM as layered defense. All functions sit in one box, so one failure affects them all.
An IPS that blocks on a false positive can cut off a business service. Test new rules in detection mode before turning on blocking.
Check yourself
What is the difference between an IDS and an IPS?
An IDS detects and alerts, while an IPS sits inline and can block the traffic.
Which firewall type can tell two applications apart when both use port 443?
A Layer 7 firewall, which inspects application data.
Which tool detects a rogue access point plugged into the office network?
A wireless intrusion prevention system (WIPS).
Topic 3 of 14 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.