Match each Intrusion Detection/Prevention System (IDS/IPS) architectural model or detection mechanism on the left to its corresponding operational deployment scenario on the right.
- Protocol Anomaly-Based NIDSEvaluates network communications against published RFC standards to identify malformed packet headers without directly blocking traffic.
- Out-of-Band Passive NIDS via Hardware TAPReceives duplicated full-duplex traffic streams from physical link breakages to inspect packets with zero added network transmission latency.
- In-Band Inline NIPSSits directly in the flow of traffic on a security boundary to actively drop malicious frames and inject TCP resets in real time.
- Host-Based IPS (HIPS)Monitors kernel system calls and critical system registry modifications locally on an enterprise application server.
Answer
Protocol Anomaly-Based NIDS matches with protocol evaluation against RFC standards; Out-of-Band Passive NIDS via Hardware TAP matches with receiving duplicated full-duplex traffic with zero added latency; In-Band Inline NIPS matches with sitting directly in the flow of traffic to drop malicious frames in real time; Host-Based IPS (HIPS) matches with monitoring kernel system calls and system registry modifications locally.
Each deployment model corresponds directly to its architectural placement and inspection logic: HIPS focuses on endpoint OS internals; Inline NIPS sits directly in-path for immediate active mitigation; Passive TAP deployments duplicate traffic to guarantee zero network latency; Protocol anomaly-based NIDS inspects traffic against formal RFC specifications.
Step-by-Step Solution
Key Concept
Architectural placement (in-band vs out-of-band, host vs network) and detection mechanics (signature, anomaly, protocol analysis) of IDS and IPS systems.