Examkin

Question

Difficulty: MediumIntrusion Detection and Prevention Systems (IDS/IPS)

A network security administrator is evaluating network security monitoring appliances for an enterprise network segment that hosts time-sensitive industrial SCADA controllers. The team is deciding between installing an out-of-band passive Network Intrusion Detection System (NIDS) fed by a hardware network TAP versus an in-band inline Network Intrusion Prevention System (NIPS). Which of the following statements correctly identify operational trade-offs or characteristics of deploying the passive NIDS architecture over the inline NIPS architecture? (Select TWO.)

  1. The passive NIDS deployment introduces zero processing latency into the primary traffic path, avoiding potential disruption to time-sensitive control traffic.Answer
  2. The passive NIDS cannot directly stop inline malicious packets in real time before they arrive at the target system.Answer
  3. C
    The passive NIDS is restricted to analyzing Layer 2 Ethernet headers and cannot inspect Layer 7 application protocol payloads from mirrored traffic.
  4. D
    The passive NIDS automatically decrypts and inspects HTTPS traffic on port 443 without requiring SSL/TLS certificates or private key access.

Answer

The passive NIDS deployment introduces zero processing latency into the primary traffic path and cannot directly stop inline malicious packets in real time before they arrive at the target system.
Out-of-band passive NIDS deployments utilize network TAPs or mirror ports to receive copies of traffic. Consequently, live packets pass uninterrupted between source and destination without experiencing processing latency from the inspection engine. Because the NIDS operates on traffic duplicates, it lacks the ability to actively drop or alter malicious frames before they hit the target network interface.

Step-by-Step Solution

1
Analyze the structural difference between out-of-band (passive TAP) NIDS and in-band (inline) NIPS architecture.
Passive NIDS receives duplicated network traffic from a test access point (TAP) or SPAN port, whereas inline NIPS processes live traffic directly in the communication path.
Understanding physical placement determines latency impact and inline blocking capabilities.
2
Evaluate the impact of passive monitoring on packet delivery latency and prevention capability.
Since traffic flows uninhibited past the TAP, no interface queuing or inspection delay is added to the live link. However, because the system receives copies, it cannot drop malicious packets before they reach the target destination.
Out-of-band placement guarantees zero inline latency at the trade-off of active inline packet filtering.
3
Evaluate inspection capabilities regarding OSI layers and encrypted traffic on passive streams.
Passive NIDS appliances perform full deep packet inspection up to Layer 7 application data. Encryption on port 443 (HTTPS) still hides packet payloads regardless of whether monitoring is passive or inline, unless decryption keys are configured.
NIDS operates across layers up to Layer 7, but payload encryption obscures higher-layer content regardless of TAP monitoring.

Key Concept

Passive out-of-band NIDS vs Inline NIPS architectural trade-offs
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic