Examkin

Question

Difficulty: Very hardIntrusion Detection and Prevention Systems (IDS/IPS)

A network security architect is evaluating security enforcement mechanisms across an enterprise infrastructure. Match each intrusion detection/prevention architecture and engine mechanism on the left to its distinct operational characteristic or structural limitation on the right.

  • Inline NIPS utilizing signature-based detectionActively inspects packet payloads against predefined static patterns in-band, but fails to detect zero-day attacks and can cause traffic drops if asymmetric routing breaks session state across dual links.
  • Passive out-of-band NIDS connected via switch TAP/SPANIntroduces zero latency to live network traffic flows and cannot natively drop packets, relying on reactive measures like TCP RST packet injection.
  • Host-based IPS (HIPS) utilizing behavioral/anomaly detectionMonitors endpoint system calls and local process memory structures, preventing unauthorized execution but imposing host-level compute overhead.
  • Inline NIPS utilizing stateful protocol anomaly analysisCompares network traffic flows against vendor-defined RFC protocol specifications to inline-block malformed baseline traffic and unknown protocol exploits.

Answer

Inline NIPS utilizing signature-based detection matches with active in-band inspection against static patterns that can suffer under asymmetric routing; Passive out-of-band NIDS via TAP/SPAN matches with zero-latency passive monitoring relying on reactive TCP RST generation; Host-based IPS (HIPS) utilizing behavioral/anomaly detection matches with endpoint system call monitoring that consumes local host compute resources; Inline NIPS utilizing stateful protocol anomaly analysis matches with in-band enforcement comparing network flows against RFC protocol baseline standards.
Each deployment model and engine mechanism aligns strictly with its functional placement and detection methodology: inline signature NIPS inspects in-path traffic for known attack patterns but is vulnerable to state loss under asymmetric routing; passive TAP/SPAN NIDS operates out-of-band without traffic latency but must rely on TCP RSTs; host-based behavioral IPS monitors OS system calls at the host cost of endpoint performance overhead; and stateful protocol anomaly NIPS enforces RFC protocol conformance to block zero-day protocol abuse.

Step-by-Step Solution

1
Differentiate between in-band (inline) and out-of-band network deployment topologies.
In-band appliances sit in the physical/logical data path with packet dropping capabilities, while out-of-band systems receive mirrored traffic copies with zero added transport latency.
Topology dictates whether an enforcement system can perform true real-time inline packet dropping versus out-of-band passive alerting and TCP reset injection.
2
Distinguish between network-based (NIDS/NIPS) and host-based (HIDS/HIPS) security agent locations.
Host-based systems analyze endpoint process calls, system memory, and unencrypted local files, whereas network-based systems inspect transit packets.
Endpoint placement allows inspection of decrypted traffic and host execution state at the cost of endpoint host CPU/memory consumption.
3
Compare signature-based detection against behavioral/anomaly and protocol state analysis mechanisms.
Signature detection matches static patterns of known threats, behavioral/anomaly detection identifies deviations from established normal baselines, and stateful protocol analysis checks adherence to RFC protocol standards.
Understanding detection engine mechanics explains how zero-day threats, malformed protocols, and known exploits are individually detected or missed.

Key Concept

Intrusion Detection and Prevention Systems (IDS/IPS) Deployment Topologies and Detection Engines
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic