Examkin

Question

Difficulty: Very hardIntrusion Detection and Prevention Systems (IDS/IPS)

An enterprise deploys active inline Network Intrusion Prevention System (NIPS) appliances on two parallel border gateway links configured for active-active asymmetric routing. Shortly after deployment, users experience intermittent session terminations and dropped connections on legitimate TCP applications. Packet inspection reveals that outbound TCP SYN packets traverse Link 1 (monitored by NIPS 1), while the corresponding SYN-ACK return packets traverse Link 2 (monitored by NIPS 2), causing NIPS 2 to drop the return packets as invalid out-of-state traffic. Which of the following architectural adjustments will eliminate these session drops while maintaining active inline threat prevention across both links?

  1. Establish a dedicated high-speed inter-appliance state-sharing connection between NIPS 1 and NIPS 2 to synchronize TCP flow tables in real time.Answer
  2. B
    Relocate both NIPS appliances to out-of-band SPAN ports on the core switches so they can perform passive TCP stream reassembly.
  3. C
    Reconfigure the inline NIPS engine to use signature-based pattern matching exclusively rather than anomaly-based heuristic inspection.
  4. D
    Modify the NIPS firewall rulebase to remap TCP application traffic to UDP port 53 to bypass stateful handshake verification.

Answer

The correct architecture requires establishing a dedicated inter-appliance state-sharing bus between NIPS 1 and NIPS 2 to synchronize TCP session state tables across both active asymmetric paths.
Establishing a state-synchronization link between dual inline NIPS appliances allows TCP session creation records from NIPS 1 to be mirrored immediately to NIPS 2. Consequently, when return SYN-ACK traffic arrives at NIPS 2 via an asymmetric route, NIPS 2 recognizes the established session state and passes the legitimate traffic inline without dropping it.

Step-by-Step Solution

1
Analyze the network failure symptoms and asymmetric routing context.
Inline NIPS units perform stateful inspection. When TCP SYN travels via Link 1 and SYN-ACK returns via Link 2, NIPS 2 sees an unacknowledged SYN-ACK without an established session entry, causing an out-of-state packet drop.
Inline NIPS appliances enforce strict TCP state machine tracking to defend against out-of-sequence evasion techniques.
2
Evaluate constraint requirements: preserve active inline prevention while supporting asymmetric paths.
Changing to passive out-of-band (SPAN/TAP) resolves state tracking issues but forfeits inline blocking capabilities.
Active inline prevention (NIPS) requires the appliance to sit directly in the forwarding path to drop malicious frames in real time.
3
Determine the optimal state-synchronization design for dual-homed inline NIPS.
Connecting NIPS 1 and NIPS 2 via a high-speed state-synchronization link updates both appliances' session tables dynamically, allowing NIPS 2 to recognize the flow initiated at NIPS 1.
State-sharing cluster links enable distributed stateful inspection across redundant asymmetric network topologies.

Key Concept

Stateful Inspection and Asymmetric Routing in Inline NIPS Deployment
Estimated Time:3m 0s
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic