Examkin

Soru

Zorluk: OrtaIntrusion Detection and Prevention Systems (IDS/IPS)

Match each intrusion detection or prevention system (IDS/IPS) architecture and mechanism on the left to its corresponding operational scenario on the right.

  • Host-Based Intrusion Prevention System (HIPS)Monitors localized system call activity and memory operations to block buffer overflow attempts on a specific server.
  • Inline Network Intrusion Prevention System (NIPS)Sits directly in the primary network traffic path to actively drop malicious TCP SYN flood packets before they hit internal targets.
  • Passive Network Intrusion Detection System (NIDS)Analyzes duplicated packets from a physical TAP interface to log security events without introducing packet forwarding delay.
  • Behavioral/Anomaly-Based Detection EngineDetects previously unknown zero-day malware by flagging significant statistical departures from an established traffic baseline.

Cevap

Host-Based IPS matches local system call and memory monitoring; Inline NIPS matches active stream blocking in the live traffic path; Passive NIDS matches out-of-band traffic monitoring via TAP/SPAN; Behavioral/Anomaly-Based Engine matches flagging statistical baseline departures for zero-day threats.
Each deployment model corresponds to a specific functional capability based on system placement (host vs. network), traffic path integration (in-band vs. out-of-band), and detection logic (signature vs. anomaly).

Adım Adım Çözüm

1
Differentiate host-based positioning from network-based positioning.
Host-based solutions inspect system calls, local files, and memory spaces on individual servers, whereas network-based solutions inspect transit traffic across network links.
Location determines whether the security control monitors OS-level events or raw packet payloads.
2
Differentiate inline active prevention from out-of-band passive detection.
Inline positioning enables real-time packet drops and session termination, while passive out-of-band monitoring analyzes copied traffic streams without causing latency.
In-band interfaces can actively block threats on live links, whereas TAP/SPAN ports receive secondary feeds suitable for auditing and alerting.
3
Distinguish signature-based rules from anomaly/behavioral analysis.
Behavioral detection uses baseline profiles to catch zero-day activity, whereas signature detection matches traffic against static known attack patterns.
Unknown threats lack existing signature rules, requiring baseline deviation tracking for effective identification.

Anahtar Kavram

Intrusion Detection and Prevention System (IDS/IPS) Deployment Models and Detection Mechanisms
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Intrusion Detection and Prevention Systems (IDS/IPS)

Bu konudan daha fazla soru