Examkin

Question

Difficulty: EasyIntrusion Detection and Prevention Systems (IDS/IPS)

A network administrator needs to deploy a security control that inspects live network traffic and actively drops malicious packets in real time before they reach internal network resources. Which of the following devices or deployments best fulfills this requirement?

  1. An inline Network Intrusion Prevention System (NIPS)Answer
  2. B
    A passive Network Intrusion Detection System (NIDS) connected to a switch SPAN port
  3. C
    A Port/Protocol Access Control List (ACL) configured to permit Port 23 for secure SSH administrative traffic
  4. D
    A Host-based Intrusion Detection System (HIDS) configured to process Layer 2 Ethernet frames across the switch fabric

Answer

An inline Network Intrusion Prevention System (NIPS)
An inline Network Intrusion Prevention System (NIPS) is positioned in-band within the network data path. This placement enables it to analyze live network traffic and actively drop or block malicious packets before they arrive at their internal destination.

Step-by-Step Solution

1
Identify the primary requirement specified in the scenario.
The requirement calls for an active network security device deployed in line to inspect traffic and drop malicious packets in real time.
Understanding whether the system requires active prevention or passive monitoring dictates the architecture needed.
2
Differentiate between Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS).
IPS devices operate inline (in-band) to actively block threats, whereas IDS devices operate out-of-band to passively detect and alert.
Because the goal is to stop malicious packets before they reach destination hosts, an inline NIPS is the correct selection.

Key Concept

Inline Intrusion Prevention (NIPS) vs. Passive Intrusion Detection (NIDS)
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic