Examkin

Question

Difficulty: HardIntrusion Detection and Prevention Systems (IDS/IPS)

A system auditor observes that malicious encrypted TLS command-and-control (C2) traffic traversing an internal server VLAN went completely undetected by a newly installed Network Intrusion Detection System (NIDS) connected to a core switch SPAN port. The organization requires a security solution that can inspect host system calls, file integrity changes, and decrypted application memory buffers on critical servers without altering network physical cabling or introducing a single point of failure that causes latency on the switch hardware. Which solution should be implemented to fulfill these security and architectural requirements?

  1. Deploy a Host-based Intrusion Detection System (HIDS) directly on the critical target servers.Answer
  2. B
    Reconfigure the core switch SPAN port to mirror Layer 2 Ethernet frames instead of Layer 3 IP packets so the NIDS can decode encrypted payloads.
  3. C
    Re-architect the NIDS into an inline Network Intrusion Prevention System (NIPS) directly on the core switch link to intercept and inspect encrypted packet headers.
  4. D
    Modify the NIDS detection signatures to inspect TCP port 80 traffic instead of TCP port 443 traffic to bypass TLS encryption processing.

Answer

Deploying a Host-based Intrusion Detection System (HIDS) directly on the critical target servers provides local process, file integrity, and decrypted memory visibility without impacting network switch latency or introducing single-point-of-failure hardware topology dependencies.
Deploying a Host-based Intrusion Detection System (HIDS) directly on the target servers allows inspection of host system calls, unencrypted memory buffers, system logs, and file modifications. Because HIDS operates on the endpoint OS rather than inline on the physical network switch, it avoids introducing network latency or inline failure points while solving the network encryption visibility gap.

Step-by-Step Solution

1
Analyze the limitation of out-of-band network-level monitoring (NIDS) against encrypted traffic.
Network-based passive sensors (NIDS) connected to SPAN/TAP ports only inspect network packet payloads in transit, which remain encrypted under TLS/SSL.
Out-of-band NIDS cannot inspect payload content or host memory without TLS session keys or host-level access.
2
Evaluate host-level versus network-level deployment options against constraints.
Host-based Intrusion Detection Systems (HIDS) monitor operating system calls, host log files, process activity, and unencrypted memory buffers locally on the host.
HIDS bypasses network transport encryption limitations by operating at the OS level while remaining out of the physical network forwarding path.
3
Select the host security solution that meets performance and reliability requirements.
Installing a HIDS on the target servers provides the necessary threat detection without adding physical latency or inline hardware network failure risks to switch links.
It fulfills the requirement for deep payload and host-state inspection without introducing inline network bottlenecks.

Key Concept

HIDS vs NIDS/NIPS Visibility and Deployment Architecture
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic