Examkin

Question

Difficulty: MediumIntrusion Detection and Prevention Systems (IDS/IPS)

An organization is updating its perimeter defenses to protect a cluster of public-facing web servers from known exploit signatures. The security policy mandates that malicious traffic must be actively blocked in real time before reaching the internal network segment, while ensuring zero processing load added to the web servers' host operating systems. Which deployment architecture best fulfills these requirements?

  1. In-band Network Intrusion Prevention System (NIPS)Answer
  2. B
    Out-of-band Network Intrusion Detection System (NIDS) connected to a SPAN port
  3. C
    Host-based Intrusion Prevention System (HIPS) installed on each server
  4. D
    Stateless Access Control List (ACL) configured on the boundary switch

Answer

The in-band Network Intrusion Prevention System (NIPS) is the correct architectural choice.
An in-band (inline) NIPS sits directly in the communication path between the external network and internal servers. It inspects live network traffic against attack signatures and actively drops malicious packets before they reach destination hosts, all while offloading inspection processing from host operating systems to dedicated network hardware.

Step-by-Step Solution

1
Evaluate real-time blocking vs passive monitoring requirements.
The requirement specifies actively blocking malicious traffic before it reaches internal servers, ruling out passive/out-of-band monitoring tools like NIDS.
Out-of-band NIDS receive mirrored traffic and cannot prevent initial packet delivery.
2
Assess host resource constraints versus dedicated network appliance deployment.
The requirement mandates zero processing overhead on web server OSs, ruling out Host-based IPS (HIPS).
HIPS software consumes host CPU and memory resources to perform local inspection.
3
Verify inspection depth capabilities.
Known exploit signatures require payload-level deep packet inspection, ruling out simple stateless ACLs.
Stateless ACLs only evaluate basic packet header parameters such as source/destination IP addresses and port numbers.

Key Concept

Inline Network Intrusion Prevention System (NIPS) Placement and Functionality
Estimated Time:1m 30s
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic