156-315.75 · Question #604
Refer to the network topology below. You have IPS Software Blades active on the Security Gateways sglondon, sgla, and sgny, but still experience attacks on the Web server in the New York DMZ. How is…
The correct answer is A. All of these options are possible. See the full explanation below for the reasoning.
Question
Refer to the network topology below. You have IPS Software Blades active on the Security Gateways sglondon, sgla, and sgny, but still experience attacks on the Web server in the New York DMZ. How is this possible?
Options
- AAll of these options are possible.
- BThe attacker may have used a bunch of evasion techniques like using escape sequences instead of
- CSince other Gateways do not have IPS activated, attacks may originate from their networks without
- DAn IPS may combine different detection technologies, but is dependent on regular signature updates
How the community answered
(23 responses)- A78% (18)
- B4% (1)
- C13% (3)
- D4% (1)
Community Discussion
5
Samuel O.Jun 26, 2026A is correct because all three of those scenarios are real-world ways IPS gets bypassed, and I have personally seen each one in the field. Stale signatures let known exploits slip through, gateways without IPS protection become free entry points for lateral movement, and attackers with even basic evasion skills know how to craft packets that confuse signature matching engines, so no single explanation covers every attack path.
Prof. SaraJun 27, 2026Solid field perspective, Samuel, and worth adding for exam day: the reason all three distractors survive scrutiny is that they each attack a different layer of the IPS trust model, signatures cover known patterns, placement covers topology, and protocol anomaly detection is the control that compensates when both of those fail, which is exactly the layered-defense logic CompTIA tests under the Architecture and Design domain.
Nina C.Jun 26, 2026So I went with A on this one, and the way it clicked for me is that none of the other three options cancel each other out, they actually describe completely separate failure modes that could all be happening at the same time. Like, sgla and the others without IPS are one gap, stale signatures are a totally different gap, and evasion tricks at the packet level are a third gap that exists even if your signatures are current. The question is really asking whether you understand that IPS protection has multiple independent ways it can fail, not just one, and all three of those ways are legitimate. That made me rule out B, C, and D individually and land on A pretty confidently. My question is about option B specifically, because I am still fuzzy on the evasion piece. When they say escape sequences or encoding tricks, does that mean the attack payload is technically passing through sgny's IPS blade and the blade just does not recognize it as an attack because it looks like encoded characters, or is the traffic somehow going around the gateway entirely? I want to make sure I understand whether that is a signature matching problem or a routing problem, because it changes how I think about the fix.
Prof. SaraJun 26, 2026Picked D first, saw B and C also fit, so A wins.
Carlos M.Jun 26, 2026Saw this exact question on my exam last month and almost second-guessed myself into picking D because I kept thinking "well the signatures angle is the most obvious one," but then I remembered a pentest writeup I read where the tester chained evasion techniques AND came in through an unsecured segment, so I circled back and picked A. All three distractors describe real attack vectors that could independently let traffic slip past IPS, so if you see "how is this possible" with a list like that, the answer is almost always going to be "all of the above."