Question

Difficulty: MediumIntrusion Detection and Prevention Systems (IDS/IPS)

Match each Intrusion Detection/Prevention System (IDS/IPS) architectural model or detection mechanism on the left to its corresponding operational deployment scenario on the right.

  • Protocol Anomaly-Based NIDSEvaluates network communications against published RFC standards to identify malformed packet headers without directly blocking traffic.
  • Out-of-Band Passive NIDS via Hardware TAPReceives duplicated full-duplex traffic streams from physical link breakages to inspect packets with zero added network transmission latency.
  • In-Band Inline NIPSSits directly in the flow of traffic on a security boundary to actively drop malicious frames and inject TCP resets in real time.
  • Host-Based IPS (HIPS)Monitors kernel system calls and critical system registry modifications locally on an enterprise application server.

Answer

Protocol Anomaly-Based NIDS matches with protocol evaluation against RFC standards; Out-of-Band Passive NIDS via Hardware TAP matches with receiving duplicated full-duplex traffic with zero added latency; In-Band Inline NIPS matches with sitting directly in the flow of traffic to drop malicious frames in real time; Host-Based IPS (HIPS) matches with monitoring kernel system calls and system registry modifications locally.
Each deployment model corresponds directly to its architectural placement and inspection logic: HIPS focuses on endpoint OS internals; Inline NIPS sits directly in-path for immediate active mitigation; Passive TAP deployments duplicate traffic to guarantee zero network latency; Protocol anomaly-based NIDS inspects traffic against formal RFC specifications.

Step-by-Step Solution

1
Identify the core operational characteristics of network vs host placement.
Host-based mechanisms (HIPS) inspect OS-level events like system calls and registry keys on endpoints, matching local server monitoring.
NIDS/NIPS operate on network traffic streams, whereas HIPS operates directly within the operating system host environment.
2
Differentiate between in-band (inline) active prevention and out-of-band passive detection.
In-band inline NIPS sits directly in the forwarding path to actively block traffic, while out-of-band passive NIDS via TAPs receives copied traffic to avoid introducing propagation delay/latency.
Inline devices are active inline single points of transit that can drop packets; TAP devices copy signals passively.
3
Analyze detection methodology logic (protocol anomaly vs signature/behavior).
Protocol anomaly detection relies on defined rules of protocol compliance (RFC standards) to detect non-standard structure or abnormal behavior.
Protocol anomaly engines establish expected standard behavior by baseline RFC definitions.

Key Concept

Architectural placement (in-band vs out-of-band, host vs network) and detection mechanics (signature, anomaly, protocol analysis) of IDS and IPS systems.
Rate this question