Examkin

Question

Difficulty: MediumIntrusion Detection and Prevention Systems (IDS/IPS)

A security engineer is tasked with monitoring a high-traffic enterprise network segment to identify zero-day attacks and unauthorized behavioral deviations. The organization requires that the monitoring solution must not introduce processing latency, drop legitimate packets during peak traffic hours, or create a single point of failure on the link. Which deployment architecture and detection method should the engineer implement?

  1. An out-of-band NIDS utilizing anomaly-based detectionAnswer
  2. B
    An inline NIPS utilizing signature-based detection
  3. C
    An out-of-band NIDS utilizing signature-based detection
  4. D
    An inline NIPS utilizing anomaly-based detection

Answer

An out-of-band Network Intrusion Detection System (NIDS) utilizing anomaly-based detection logic satisfies all requirements by inspecting copied traffic passively without latency while detecting unknown zero-day threats.
Out-of-band NIDS deployments receive copied frame streams from a network TAP or SPAN port, ensuring zero latency impact and removing single-point-of-failure risks on the active link. Anomaly-based detection establishes a baseline of normal network behavior, allowing the system to identify zero-day attacks and abnormal traffic patterns that lack known signatures.

Step-by-Step Solution

1
Analyze placement topology requirements (inline vs. out-of-band).
Requirements specify zero added latency, no packet drops during congestion, and no single point of failure, which eliminates inline (in-band) NIPS architectures in favor of passive (out-of-band) NIDS connected via TAP or SPAN.
Inline devices process traffic in real-time on the wire, introducing latency and potentially blocking traffic if overwhelmed.
2
Analyze detection mechanism requirements (signature-based vs. anomaly-based).
The requirement to catch zero-day attacks and unknown behavioral deviations mandates anomaly-based (or baseline/behavioral) detection logic.
Signature-based engines require pre-existing pattern definitions and cannot detect previously unseen zero-day exploits.
3
Synthesize placement and detection engine selection.
Combining out-of-band passive placement with anomaly-based detection logic fulfills both performance constraints and threat detection goals.
This combination ensures full visibility of novel threats while keeping live network performance unaffected.

Key Concept

NIDS vs NIPS Placement Topology and Detection Engine Logic
Estimated Time:1m 30s
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic