Examkin

Question

Difficulty: MediumIntrusion Detection and Prevention Systems (IDS/IPS)

A network security administrator needs to implement a security solution that continuously monitors network traffic and actively drops malicious packets in real time before they can reach critical application servers. Which device type and deployment configuration best fulfills these requirements?

  1. A Network Intrusion Prevention System (NIPS) deployed inline (in-band) within the network traffic flow.Answer
  2. B
    A Network Intrusion Detection System (NIDS) connected passively out-of-band via a switch SPAN port.
  3. C
    A Host-based Intrusion Detection System (HIDS) inspecting Layer 2 frames on the core switch.
  4. D
    A Network Intrusion Prevention System (NIPS) configured out-of-band to intercept unencrypted Telnet traffic on Port 22.

Answer

A Network Intrusion Prevention System (NIPS) deployed inline (in-band) within the network traffic flow.
A Network Intrusion Prevention System (NIPS) installed inline (in-band) processes all network traffic passing through its interfaces. This placement allows the appliance to analyze packet payloads against threat signatures or anomalies and immediately drop malicious packets before they reach target servers.

Step-by-Step Solution

1
Analyze the operational requirement for active prevention.
The scenario requires stopping malicious packets in real time before they arrive at application servers, which demands a prevention system (IPS) rather than a detection-only system (IDS).
Detection systems (IDS) only generate alerts or passive logs after traffic passes.
2
Evaluate network placement topology (inline vs out-of-band).
Inline (in-band) placement positions the security appliance directly between network segments so all traffic must traverse the device.
Out-of-band topologies receive duplicate copies of traffic from TAP or SPAN ports, making inline packet dropping impossible.

Key Concept

Inline NIPS Deployment vs. Passive NIDS Placement
Estimated Time:1m 15s
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic