Examkin

Question

Difficulty: MediumIntrusion Detection and Prevention Systems (IDS/IPS)

A network security administrator needs to monitor traffic destined for a cluster of internal database servers to identify malicious payload patterns. The solution must ensure that security monitoring introduces zero processing latency to live database transactions and cannot interrupt network traffic if the monitoring device fails or experiences a hardware fault. Which of the following deployment options best satisfies these requirements?

  1. Deploy a Network Intrusion Detection System (NIDS) out-of-band using a switch TAP or SPAN port.Answer
  2. B
    Deploy an inline Network Intrusion Prevention System (NIPS) directly on the primary Layer 3 gateway interface.
  3. C
    Configure an inline Network Intrusion Prevention System (NIPS) across an untagged native VLAN trunk.
  4. D
    Deploy a Host-based Intrusion Detection System (HIDS) configured to intercept packets over SSH port 23 traffic streams.

Answer

Deploying an out-of-band Network Intrusion Detection System (NIDS) fed by a switch port mirror (SPAN) or physical test access point (TAP) guarantees that live traffic is unaffected by monitoring overhead or device reboot events.
An out-of-band Network Intrusion Detection System (NIDS) operates passively by receiving mirrored copies of network traffic via a switch Port Analyzer (SPAN) or physical TAP. Because the NIDS is not placed directly in the network transit path, it adds no latency to live database requests and cannot interrupt production traffic if the NIDS device crashes or loses power.

Step-by-Step Solution

1
Analyze the operational constraints presented in the scenario.
Identified key requirements: zero latency impact on live production traffic, passive monitoring, and resilience against single point of network failure.
Production database environments require strict latency controls and high availability.
2
Compare in-band (inline) vs. out-of-band (passive) monitoring architectures.
Inline systems (NIPS) inspect traffic directly in the data path, introducing latency and potential failure points. Out-of-band systems (NIDS) analyze copied packets.
Out-of-band architecture uses SPAN ports or TAPs to duplicate frames without interrupting original packet delivery.
3
Select the deployment topology that fulfills all constraints.
A passive NIDS receiving traffic via a TAP or SPAN port.
If an out-of-band NIDS fails, the primary network path continues forwarding database traffic without interruption.

Key Concept

In-band (Inline NIPS) vs. Out-of-band (Passive NIDS) Deployment Architecture
Estimated Time:1m 30s
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic