Examkin

Soru

Zorluk: Çok zorIntrusion Detection and Prevention Systems (IDS/IPS)

An enterprise monitors its internal data center network using a passive Network Intrusion Detection System (NIDS) connected to a switch SPAN port. During a security incident, an attacker successfully exploits a vulnerability on a Linux target server by transmitting crafted TCP packets containing overlapping sequence numbers with conflicting data payloads (a TCP stream segmentation evasion attack). Although traffic reached the sensor, the NIDS failed to generate an alert because its stream reassembly engine interpreted the overlapping segments differently than the target server's IP/TCP protocol stack. Which of the following actions best addresses this detection failure while maintaining zero impact on network latency?

  1. Tune the NIDS stream reassembly engine's target-oriented policy to match the reassembly behavior of the target host's operating system.Cevap
  2. B
    Relocate the NIDS sensor inline as an active NIPS to strip Layer 2 Ethernet headers before packets reach the target operating system.
  3. C
    Reconfigure the switch SPAN port to mirror traffic specifically on TCP port 22 instead of port 80 to prevent control flag dropping.
  4. D
    Convert the NIDS to an inline NIPS operating in passive mode to enforce drop rules at Layer 3.

Cevap

Tune the NIDS stream reassembly engine's target-oriented policy to match the reassembly behavior of the target host's operating system.
When attackers craft overlapping TCP segments, different host operating systems apply distinct rules to decide whether original or newer overlapping bytes take precedence. A passive NIDS uses stream normalization engines with target-oriented policies to align its reassembly logic with the exact operating system of the target destination host. Tuning these policies ensures the NIDS reassembles the payload identically to the target host, detecting evasive attacks out-of-band without introducing inline latency.

Adım Adım Çözüm

1
Analyze the attack mechanism and NIDS failure mode.
Identified that the attacker used TCP stream segmentation evasion (overlapping sequence numbers), which caused the passive NIDS engine to reconstruct a benign payload while the target OS reconstructed the malicious payload.
Different operating systems (e.g., Linux vs. Windows) resolve overlapping TCP sequence numbers using different prioritization rules (e.g., favoring original vs. subsequent segments).
2
Evaluate deployment constraints.
The solution must maintain zero impact on network propagation delay and latency.
Converting to an inline network intrusion prevention system (NIPS) introduces processing delay and single points of failure, violating the requirement.
3
Select the appropriate NIDS configuration fix.
Configure target-oriented session reassembly policies on the out-of-band NIDS.
Target-oriented reassembly allows the passive sensor to apply host-specific TCP reassembly rules per target IP address, neutralizing evasion attacks out-of-band without adding network latency.

Anahtar Kavram

Target-Oriented TCP Stream Reassembly in Out-of-Band NIDS
Bu soruyu puanla

Konular

Intrusion Detection and Prevention Systems (IDS/IPS)

Bu konudan daha fazla soru