Examkin

Question

Difficulty: MediumIntrusion Detection and Prevention Systems (IDS/IPS)

A network security team needs to implement intrusion monitoring across a high-throughput enterprise core switch link carrying latency-sensitive voice and transactional traffic. The security policy mandates that the monitoring deployment must not introduce latency, perform inline packet modification, or risk creating a single point of network failure if the monitoring service fails. Which deployment architecture and system type best meets these requirements?

  1. A Network Intrusion Detection System (NIDS) deployed out-of-band using a switch SPAN/mirror portAnswer
  2. B
    A Network Intrusion Prevention System (NIPS) deployed in-band with active inline packet dropping
  3. C
    A Host-based Intrusion Detection System (HIDS) installed directly on core layer switch control planes
  4. D
    A stateless network Access Control List (ACL) configured on the core distribution routers

Answer

A Network Intrusion Detection System (NIDS) deployed out-of-band using a switch SPAN/mirror port
The option specifying a Network Intrusion Detection System (NIDS) deployed out-of-band using a switch SPAN or mirror port is correct because out-of-band passive deployments inspect duplicate copies of network packets. This architecture guarantees that monitoring operations do not introduce serialization latency into live real-time streams and ensures that a failure of the NIDS sensor will not disrupt production network traffic.

Step-by-Step Solution

1
Analyze the operational constraints required by the enterprise network scenario
Identified three critical constraints: zero added latency, no active packet dropping/modification, and zero risk of network disruption upon monitoring device failure.
Understanding architectural constraints determines whether an in-band (inline) or out-of-band (passive) solution is appropriate.
2
Evaluate system placement options (in-band prevention vs out-of-band detection)
In-band (inline) IPS devices sit directly in the traffic flow path and can introduce latency or drop connection traffic if overloaded. Out-of-band (passive) IDS devices monitor mirrored copy traffic from a SPAN or TAP port.
Passive out-of-band deployment ensures live network throughput is completely unaffected by sensor hardware failures or processing bottlenecks.
3
Select the system type and deployment mechanism matching all requirement criteria
A NIDS deployed passively via a SPAN port satisfies network-wide traffic visibility while adhering to zero-latency and high-availability operational requirements.
NIDS provides signature-based and anomaly detection on network traffic copies without sitting directly in the active forwarding path.

Key Concept

Passive Out-of-Band NIDS vs Inline NIPS Placement
Estimated Time:1m 30s
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic