An enterprise network security engineer is evaluating the deployment of a passive Network Intrusion Detection System (NIDS) connected via a switch SPAN port versus an inline Network Intrusion Prevention System (NIPS) placed at the perimeter firewall interface. Which of the following statements accurately describe the operational trade-offs and functional behaviors of these two implementations? (Select TWO.)
- The inline NIPS can actively drop malicious traffic in real time before it reaches internal hosts, but it introduces network latency and a potential single point of failure.Cevap
- The passive NIDS analyzes out-of-band traffic copies, ensuring zero impact on live network throughput and latency while providing threat visibility.Cevap
- CThe passive NIDS can reliably drop the initial exploit packet of a zero-day attack by inspecting mirrored packets at Layer 2 before frame encapsulation occurs.
- DThe inline NIPS processes network traffic using switch port mirroring, allowing it to inspect decrypted TLS packets without inline interface configuration.
Cevap
The inline NIPS actively drops malicious traffic in real time at the cost of adding latency and introducing a potential single point of failure, whereas the passive NIDS inspects out-of-band traffic copies without affecting network latency or throughput.
Inline NIPS operates in-band, inspecting live traffic to drop malicious packets before they hit internal systems, though this adds processing latency and introduces a potential single point of failure. Conversely, passive NIDS receives duplicated frames from a SPAN port out-of-band, preserving maximum network performance and throughput without introducing latency.
Adım Adım Çözüm
Anahtar Kavram
Operational trade-offs between in-band NIPS (active prevention, latency, failure point) and out-of-band NIDS (passive monitoring, zero latency impact, detection only).