Examkin

Question

Difficulty: MediumIntrusion Detection and Prevention Systems (IDS/IPS)

A company is updating its perimeter network architecture to defend against automated exploit attacks targeted at public-facing application servers. The security strategy requires a device positioned directly in the traffic flow that can inspect packet payloads in real time and automatically drop malicious frames before they cross into the internal segment. Which security appliance deployment best satisfies these active mitigation requirements?

  1. A Network Intrusion Prevention System (NIPS) deployed inline between the perimeter router and the internal web networkAnswer
  2. B
    A Network Intrusion Detection System (NIDS) connected to a mirrored SPAN port on the core perimeter switch
  3. C
    A Host-based Intrusion Detection System (HIDS) deployed on Layer 2 switch management interfaces
  4. D
    A stateless firewall filter evaluating transport Layer 4 protocol headers for payload signatures on Telnet port 23

Answer

A Network Intrusion Prevention System (NIPS) deployed inline between the perimeter router and the internal web network
Deploying a Network Intrusion Prevention System inline places the device directly inside the network traffic path (in-band). This enables the system to perform deep packet inspection on passing traffic and immediately block or drop malicious packets before they reach internal application servers.

Step-by-Step Solution

1
Identify the operational requirement specified in the scenario
The scenario demands an active prevention solution placed directly in the traffic path to inspect payloads and drop malicious packets immediately.
Active packet dropping requires in-band (inline) placement so traffic must pass through the device.
2
Evaluate the distinction between passive detection and active inline prevention
NIDS operates out-of-band via SPAN/TAP ports (passive monitoring), whereas NIPS operates inline (active prevention).
Only an inline appliance can drop packets mid-stream before they arrive at host destinations.
3
Select the matching deployment model
Deploying a Network Intrusion Prevention System (NIPS) inline between the perimeter router and internal segment satisfies all requirements.
Inline NIPS combines deep packet payload inspection with real-time active traffic blocking.

Key Concept

Inline NIPS vs. Passive NIDS Deployment
Estimated Time:1m 15s
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic