Examkin

Question

Difficulty: HardNetwork Security Monitoring and Alerting

During a post-incident review of a cloud VPC environment, a network security monitoring (NSM) analyst inspects the following log generated by a monitoring sensor attached to a Virtual Network TAP:

text
[ALERT] 2026-07-27T14:22:05.112482 [GID: 1] [SID: 2049110] [REV: 3]
[Classification: A Network Trojan was detected] [Priority: 1]
{TCP} 10.150.4.52:49812 -> 198.51.100.77:8443
[Payload Snippet]: 47 45 54 20 2f 61 70 69 2f 76 31 2f 63 6f 6d 6d 61 6e 64 73
[TLS SNI]: c2.external-domain.invalid | [JA3 Fingerprint]: e7d705a3286e19ea42f589255019d675

Although the Snort/Suricata rule applied to the sensor was configured with a `drop` action, packet telemetry reveals the outbound C2 session established successfully and transferred data. Which of the following best explains why the malicious traffic was not blocked?

  1. The sensor received mirrored traffic out-of-band via a TAP, limiting its capability to passive detection (NIDS) rather than inline prevention (NIPS).Answer
  2. B
    The sensor misclassified the preventive control rule as a deterrent control because the SIEM correlation engine failed to map the priority header.
  3. C
    The sensor automatically diverted the unblocked connection into an isolation honeypot network due to a SIEM correlation rule override.
  4. D
    The analyst should have configured host-level egress firewall rules on the destination server instead of relying on network signature evaluation.

Answer

The sensor was deployed out-of-band via a network TAP interface, restricting it to passive Network Intrusion Detection System (NIDS) functionality, which cannot actively drop inline network traffic.
The correct answer correctly identifies that a sensor connected to a Virtual Network TAP operates out-of-band in a passive Network Intrusion Detection System (NIDS) role. Because traffic is mirrored to the sensor, the sensor has no physical or logical path to drop or modify packets passing between the source host and the remote destination.

Step-by-Step Solution

1
Analyze the sensor deployment topology described in the scenario stem.
Identified that the NSM sensor receives network telemetry from a Virtual Network TAP (Test Access Point).
TAP interfaces and mirrored SPAN ports copy network traffic for out-of-band analysis without inserting the monitoring device into the physical or virtual inline transit path.
2
Evaluate the functional difference between passive detection (NIDS) and active prevention (NIPS) capabilities.
Determined that `drop` or `reject` rule actions require an inline deployment (NIPS) to actively drop packets in transit.
An out-of-band sensor receives packet copies after or as they pass through switch fabrics; issuing a packet drop command on a mirror stream cannot halt the original packets.
3
Conclude why the malicious connection succeeded despite the rule configuration.
The failure to prevent traffic stems from architecture deployment limitations (out-of-band TAP), not software rule syntax errors.
Matching active block rules on passive tap monitoring sensors yields alerts but cannot enforce traffic inline.

Key Concept

Passive NIDS vs. Inline NIPS Deployment Architecture
Estimated Time:2m 0s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic