Examkin

Question

Difficulty: MediumIntrusion Detection and Prevention Systems (IDS/IPS)

A network administrator receives security alerts from a passive Network Intrusion Detection System (NIDS) connected to a switch SPAN port, indicating that malicious payloads are reaching internal web servers. Although the NIDS successfully logs the suspicious traffic, it fails to stop the attacks. Which network security deployment modification would enable active packet dropping to prevent malicious traffic from reaching the servers?

  1. Deploy a Network Intrusion Prevention System (NIPS) in-band along the traffic path.Answer
  2. B
    Place an implicit deny rule at the top of the ingress router Access Control List (ACL).
  3. C
    Map the out-of-band NIDS sensor to monitor Layer 2 frames instead of Layer 7 application traffic.
  4. D
    Reconfigure the NIDS filters to evaluate destination port numbers rather than payload contents.

Answer

Deploy a Network Intrusion Prevention System (NIPS) in-band along the traffic path.
A Network Intrusion Prevention System (NIPS) deployed in-band (inline) sits directly within the network traffic flow. Unlike passive out-of-band NIDS solutions receiving port mirrors, an inline NIPS actively inspects live traffic and drops malicious packets before they reach destination systems.

Step-by-Step Solution

1
Evaluate the current monitoring architecture.
The current NIDS operates out-of-band via a switch SPAN port.
Out-of-band systems receive mirrored copies of packets passively, enabling logging and alerting but preventing real-time packet manipulation or inline blocking.
2
Determine the functional requirement for active prevention.
The requirement is to intercept and block malicious traffic before destination arrival.
Active threat mitigation requires an inline (in-band) device through which all production traffic physically flows.
3
Select the appropriate device and placement topology.
Deploy an inline Network Intrusion Prevention System (NIPS).
An in-band NIPS evaluates live traffic stream frames and drops malicious packets in real time.

Key Concept

Inline (In-Band) NIPS vs. Out-of-Band (Passive) NIDS Architecture
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic