Examkin

Soru

Zorluk: OrtaIntrusion Detection and Prevention Systems (IDS/IPS)

A network security administrator is tasked with deploying a solution to protect internal web servers from malicious payload attacks. The deployment requirements specify that the device must inspect passing packet payloads in real time and actively drop malicious packets before they reach the destination hosts. Which of the following system types and deployment modes should the administrator implement?

  1. An inline Network Intrusion Prevention System (NIPS) positioned directly in the network traffic pathCevap
  2. B
    A passive Network Intrusion Detection System (NIDS) connected to a switch SPAN port
  3. C
    A Host-based Intrusion Detection System (HIDS) installed on the perimeter gateway router
  4. D
    A stateless firewall with access control lists (ACLs) configured to block standard port numbers

Cevap

An inline Network Intrusion Prevention System (NIPS) positioned directly in the network traffic path
An inline Network Intrusion Prevention System (NIPS) sits directly in the flow of traffic. This in-band position allows it to analyze packet payloads and drop malicious packets before they traverse the rest of the network to reach target hosts.

Adım Adım Çözüm

1
Analyze the scenario requirements.
The requirement specifies deep packet payload inspection and real-time active inline dropping of malicious packets before destination delivery.
Understanding the need for active prevention versus passive notification dictates the system selection.
2
Compare Network Intrusion Detection (NIDS) and Network Intrusion Prevention (NIPS) architectures.
NIDS operates out-of-band (passive mode via SPAN/TAP), whereas NIPS operates in-band (inline mode).
Only an in-band NIPS device possesses the network positioning required to inspect and stop malicious traffic in real time.

Anahtar Kavram

NIPS vs NIDS placement architecture (In-band inline prevention vs out-of-band passive detection)
Bu soruyu puanla

Konular

Intrusion Detection and Prevention Systems (IDS/IPS)

Bu konudan daha fazla soru