Examkin

Question

Difficulty: MediumIntrusion Detection and Prevention Systems (IDS/IPS)

A network administrator installs a passive Network Intrusion Detection System (NIDS) connected to a switch SPAN port to monitor application traffic for web servers. All incoming web application traffic is encrypted end-to-end using TLS on TCP port 443. During a penetration test, simulated cross-site scripting (XSS) attacks sent inside HTTPS payloads pass through the network undetected by the NIDS. Which of the following best explains why the NIDS failed to generate an alert?

  1. The passive NIDS cannot decrypt packet payloads in transit, preventing signature matching against the encrypted application-layer attack strings.Answer
  2. B
    The NIDS operates exclusively at Layer 2 of the OSI model and is structurally incapable of analyzing TCP port headers or IP packet structures.
  3. C
    The switch SPAN port automatically filters out encrypted TCP port 443 traffic because port mirroring is reserved strictly for unencrypted UDP protocols.
  4. D
    Network-based detection systems automatically drop packets with TCP destination port 443 because TLS packets lack standard IP header checksums.

Answer

The passive NIDS failed to detect the attack because it cannot inspect packet payloads encrypted by TLS without access to session decryption mechanisms.
Network Intrusion Detection Systems (NIDS) rely on deep packet inspection (DPI) to match known attack signatures against application-layer payloads. When web application traffic is protected by TLS encryption, the HTTP payload containing the attack string (such as an XSS payload) is converted into ciphertext. A passive out-of-band NIDS connected to a SPAN port receives duplicate raw encrypted frames and lacks the cryptographic keys and inline decryption capability required to inspect the underlying payload.

Step-by-Step Solution

1
Analyze the traffic type and deployment mode described in the scenario.
The traffic uses TLS encryption on TCP port 443, and the sensor is a passive out-of-band NIDS connected via SPAN port.
Understanding where the sensor sits and what data it receives determines its visibility limits.
2
Evaluate the impact of end-to-end TLS encryption on network-based inspection.
TLS encrypts the application layer payload (HTTP request containing XSS vectors) before transmission across the wire.
Signature-based NIDS inspects unencrypted payload strings; when traffic is encrypted, the payload appears as uninterpretable ciphertext to the passive network sensor.
3
Identify the correct technical limitation causing the detection failure.
Without SSL/TLS decryption offloading or a host-based agent (HIDS/HIPS), the NIDS cannot perform deep packet inspection on encrypted payloads.
This highlights the trade-off of passive out-of-band NIDS deployments when facing modern encrypted transport protocols.

Key Concept

Impact of Payload Encryption on Network Intrusion Detection Systems
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic