A network security engineer is evaluating security monitoring controls and deployment topologies across an enterprise network. Match each intrusion detection or prevention architecture on the left with its defining operational characteristic or monitoring mechanism on the right.
- Passive Out-of-Band NIDS (via SPAN/TAP)Processes copied network frames without introducing path latency or risking network failure if the monitoring device fails.
- Inline In-Band NIPSSits directly in the active data transit stream to perform automated drop or reset actions on malicious packets in real time.
- Host-based Intrusion Detection System (HIDS)Monitors local OS system call tables, internal process memory, file integrity checksums, and host log files.
- Behavior/Anomaly-based Detection EngineEstablishes a baseline of standard network traffic metrics and triggers alerts when current activity deviates significantly from historical norms.
Cevap
Passive Out-of-Band NIDS matches with processing copied network frames without introducing path latency; Inline In-Band NIPS matches with sitting directly in the active data transit stream to drop or reset malicious packets; Host-based IDS matches with monitoring local OS system call tables, memory, file integrity, and host logs; Behavior/Anomaly-based Detection matches with establishing a baseline of standard network traffic and triggering alerts upon statistical deviations.
Passive out-of-band NIDS receives mirrored data from SPAN/TAPs to evaluate traffic without introducing latency or failure risks. Inline NIPS sits in the direct network flow to block threats in real time. Host-based IDS monitors internal OS events, registry keys, and file modifications on an endpoint. Anomaly-based detection compares current behavior against learned historical baselines.
Adım Adım Çözüm
Anahtar Kavram
Intrusion Detection and Prevention Systems (IDS/IPS) Architectural Topologies and Detection Methods