A network security administrator configures a passive Network Intrusion Detection System (NIDS) connected to a switch port mirroring session. While the system successfully logs alert notifications for unauthorized port scans, it does not stop the scanning traffic from reaching internal hosts. Which architectural characteristic explains why the NIDS cannot directly drop these attack packets?
- It is deployed out-of-band and receives a duplicate copy of network traffic rather than sitting directly in the live data path.Cevap
- BIt operates strictly at OSI Layer 2, making it incapable of inspecting or modifying Layer 3 IP traffic.
- CIt relies on SSH port 22 to send remote drop commands to host firewalls rather than inspecting packet headers.
- DIt is restricted to detecting ARP poisoning attacks and cannot evaluate port scan attack vectors.
Cevap
The NIDS is deployed out-of-band and receives duplicate traffic via port mirroring rather than sitting directly in the live network path.
Passive NIDS solutions are deployed out-of-band using switch port mirroring (SPAN) or network TAPs. Replicated traffic copies are forwarded to the NIDS while original packets continue along their primary path. Because the NIDS is not positioned inline within the live data stream, it cannot intercept, alter, or drop active network packets.
Adım Adım Çözüm
Anahtar Kavram
Passive NIDS Out-of-Band Placement vs. Inline Prevention
Tahmini Süre:45s