Examkin

Question

Difficulty: HardNetwork Security Monitoring and Alerting

A security engineer inspects network security telemetry following a simulated penetration test. The red team successfully executed a known web application exploit payload over an HTTPS connection to an internal web server. Although the Network Intrusion Prevention System (NIPS) was deployed inline and possessed the latest vendor signature for the exploit, it neither generated an alert nor dropped the malicious connection. NetFlow records confirm the attack traffic passed directly through the NIPS interface. Which of the following best explains why the monitoring and alerting controls failed to detect this attack?

  1. The NIPS lacked SSL/TLS decryption capabilities, preventing signature inspection of the encrypted packet payload.Answer
  2. B
    The NIPS was deployed passively via a network TAP, which prevented it from injecting TCP Reset (RST) packets into the stream.
  3. C
    The security team configured a deception honeypot that diverted incoming alerts into log archives rather than inline enforcement.
  4. D
    The engineer selected a Web Application Firewall (WAF) rule to block transport-layer SYN floods rather than inspecting application layer payloads.

Answer

The NIPS lacked SSL/TLS decryption capabilities, preventing signature inspection of the encrypted packet payload.
Network Intrusion Prevention Systems (NIPS) perform deep packet inspection by comparing packet payloads against known attack signatures. When web traffic is encrypted using HTTPS (SSL/TLS), the payload content is obfuscated as ciphertext. Unless the NIPS is configured with SSL/TLS decryption (TLS offloading/inspection), the signature engine cannot read the underlying HTTP payload to match known exploit patterns, allowing the malicious traffic to pass unhindered despite the NIPS being inline and updated.

Step-by-Step Solution

1
Analyze the scenario parameters and network architecture
The traffic was sent over HTTPS (encrypted via SSL/TLS), passed inline through a updated NIPS sensor, but went undetected.
Understanding the delivery protocol (HTTPS) is critical to identifying why deep packet inspection failed.
2
Evaluate sensor inspection mechanics against encrypted protocols
Network Intrusion Prevention Systems rely on matching packet payloads against known signatures. Without SSL/TLS decryption (TLS inspection), packet payloads are encrypted, rendering signatures ineffective.
Encrypted traffic obscures Layer 7 payload content from network monitoring tools unless SSL/TLS decryption is enabled on the sensor.
3
Differentiate correct root cause from distractor misconfigurations
The inability to inspect encrypted ciphertext is the direct cause of signature evaluation failure in this network monitoring context.
Eliminates distractors that confuse sensor deployment types (inline vs. passive TAP), deception technologies (honeypots), or control layer misclassifications.

Key Concept

Network Security Monitoring & TLS/SSL Decryption Requirements for NIDS/NIPS
Estimated Time:2m 0s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic