Examkin

Soru

Zorluk: KolayIntrusion Detection and Prevention Systems (IDS/IPS)

Match each intrusion detection or prevention concept with its corresponding operational characteristic.

  • Signature-Based DetectionCompares network traffic against a database of known threat patterns to identify attacks.
  • Anomaly-Based DetectionEstablishes a baseline of normal network activity and alerts on significant deviations.
  • Inline NIPS DeploymentPlaced directly in the traffic path to inspect packets and actively block unauthorized traffic.
  • Passive NIDS DeploymentConnected via a SPAN port to monitor traffic asynchronously without introducing inline latency.

Cevap

Signature-Based Detection pairs with known threat pattern database comparison; Anomaly-Based Detection pairs with baseline deviation alerting; Inline NIPS Deployment pairs with active packet blocking in the traffic path; Passive NIDS Deployment pairs with out-of-band traffic monitoring via SPAN port.
Each intrusion detection and prevention component matches its specific operational method: signature-based detection uses known threat patterns, anomaly-based detection identifies deviations from normal baselines, inline NIPS acts in-band to block malicious packets, and passive NIDS operates out-of-band via SPAN/TAP ports to monitor without adding latency.

Adım Adım Çözüm

1
Differentiate between signature-based and anomaly-based detection mechanisms.
Signature-based detection matches traffic to predefined threat definitions, whereas anomaly-based detection flags deviations from established normal baselines.
Signature detection uses specific known fingerprints, while anomaly detection focuses on behavioral variations.
2
Differentiate between inline prevention (IPS) and passive monitoring (IDS) topology placements.
Inline NIPS is placed directly in-band to drop malicious packets, while passive NIDS connects out-of-band (e.g., via SPAN port) to inspect copied packets.
Prevention systems must sit in the active data path to block traffic, while detection systems mirror traffic to avoid introducing network latency.

Anahtar Kavram

IDS/IPS Detection Mechanisms and Deployment Topologies
Bu soruyu puanla

Konular

Intrusion Detection and Prevention Systems (IDS/IPS)

Bu konudan daha fazla soru