A network technician is documenting security controls across an enterprise network infrastructure. Match each intrusion detection or prevention system deployment on the left with its defining operational capability or structural characteristic on the right.
- Inline NIPS deploymentFilters traffic in the active physical path to drop malicious packets in real time.
- Out-of-band NIDS via TAPMonitors mirrored traffic streams without introducing latency to live network links.
- Signature-based HIDSInspects local host log files and system calls against known threat patterns.
- Anomaly-based NIDSFlags network traffic dynamics that deviate from an established baseline of normal activity.
Answer
Inline NIPS deployment pairs with filtering traffic in the active physical path to drop malicious packets in real time; Out-of-band NIDS via TAP pairs with monitoring mirrored traffic streams without introducing latency; Signature-based HIDS pairs with inspecting local host log files and system calls against known threat patterns; Anomaly-based NIDS pairs with flagging network traffic dynamics that deviate from an established baseline of normal activity.
Each deployment model matches its distinct functional characteristic. Inline NIPS processes live traffic in-band to enable active prevention. Out-of-band NIDS passively analyzes duplicated traffic via TAP/SPAN ports with zero latency. Host-based IDS monitors internal endpoint events using signatures, and anomaly-based NIDS flags deviations from established traffic baselines.
Step-by-Step Solution
Key Concept
Intrusion Detection and Prevention Systems (IDS/IPS) Architecture and Detection Engines