Examkin

Question

Difficulty: EasyIntrusion Detection and Prevention Systems (IDS/IPS)

A network administrator needs to deploy a network security device at the perimeter that sits directly in the traffic flow to inspect incoming packets and actively drop detected malicious traffic in real time. Which device should be placed inline to meet this objective?

  1. Network Intrusion Prevention System (NIPS)Answer
  2. B
    Network Intrusion Detection System (NIDS) connected to a SPAN port
  3. C
    Protocol Analyzer analyzing port 80 traffic out-of-band
  4. D
    Access Control List configured on a router interface

Answer

Network Intrusion Prevention System (NIPS)
A Network Intrusion Prevention System (NIPS) is deployed in-band (inline) along the network communication path. This positioning allows it to inspect all traversing packets in real time and automatically take preventive action, such as dropping malicious packets or resetting TCP connections, before malicious traffic reaches its destination.

Step-by-Step Solution

1
Identify the key operational requirement in the scenario.
The device must operate inline to actively block and drop malicious traffic in real time.
Inline deployment ensures all traffic passes through the security system before reaching internal hosts.
2
Compare passive (detection) versus active (prevention) system capabilities.
Intrusion Detection Systems (IDS) operate passively out-of-band, whereas Intrusion Prevention Systems (IPS) operate actively in-band.
An inline NIPS has the technical capability to interrupt the traffic flow and drop malicious packets immediately.

Key Concept

Inline NIPS vs. Passive NIDS Deployment
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic