A network administrator is evaluating deployment topologies for intrusion security controls within a corporate network architecture. Which of the following statements accurately distinguish a passive Network Intrusion Detection System (NIDS) from an inline Network Intrusion Prevention System (NIPS)? (Select TWO.)
- NIDS utilizes out-of-band traffic monitoring via SPAN or TAP ports, whereas NIPS is deployed in-band directly along the network transmission path.Answer
- BNIDS operates strictly at Layer 2 of the OSI model to inspect Ethernet frames, whereas NIPS operates strictly at Layer 3 to inspect IP packet headers.
- NIPS can actively block or drop malicious network traffic inline, whereas NIDS primarily logs events and sends administrator alerts without stopping the traffic flow.Answer
- DNIDS relies on TCP port 23 to securely transmit alerts, whereas NIPS relies on UDP port 22 for active prevention enforcement.
Answer
The correct statements are that NIDS utilizes out-of-band monitoring via SPAN/TAP ports while NIPS is deployed in-band, and NIPS can actively block or drop malicious traffic inline while NIDS primarily logs events and generates alerts.
The statement regarding NIDS using out-of-band SPAN/TAP monitoring while NIPS sits in-band is correct because NIDS receives passive copies of packets while NIPS processes live traffic directly in the network path. The statement noting that NIPS actively drops malicious traffic while NIDS generates alerts is also correct because inline placement enables real-time prevention, whereas passive placement limits response to alerting.
Step-by-Step Solution
Key Concept
Placement topology and response capabilities of NIDS (out-of-band, passive alerting) versus NIPS (in-band, active inline prevention).