A network security administrator is reviewing different deployment architectures and detection logic for intrusion monitoring. Match each intrusion detection or prevention mechanism on the left with its corresponding operational description on the right.
- Passive Signature-Based NIDSPassively inspects mirrored network traffic against a database of known exploit definitions without introducing latency into the live data stream.
- Anomaly-Based NIDSReceives traffic via a SPAN port or network TAP and compares current network behavior against an established baseline of normal activity.
- Inline NIPSSits directly in the network data path to inspect live traffic and actively drop malicious packets based on known attack patterns.
- Host-Based IPS (HIPS)Monitors local system calls and file system integrity directly on an endpoint, actively blocking unauthorized system modifications.
Cevap
Passive Signature-Based NIDS matches with inspecting mirrored traffic against known exploit definitions without latency; Anomaly-Based NIDS matches with comparing SPAN/TAP traffic against a baseline of normal behavior; Inline NIPS matches with sitting in-band to actively drop malicious packets; Host-Based IPS matches with monitoring local system calls and file integrity on an endpoint to block unauthorized actions.
Each mechanism is correctly paired based on its operational scope: Passive Signature-Based NIDS uses out-of-band traffic streams to match known signatures without introducing network latency; Anomaly-Based NIDS monitors SPAN/TAP traffic for statistical deviations from normal activity baselines; Inline NIPS sits directly in-band to drop malicious packets in real time; Host-Based IPS runs on individual endpoints to protect system files and local processes.
Adım Adım Çözüm
Anahtar Kavram
Intrusion Detection and Prevention Systems (IDS/IPS) architecture, placement, and detection logic.