Examkin

Soru

Zorluk: ZorIntrusion Detection and Prevention Systems (IDS/IPS)

A network administrator needs to implement a network security control in front of a critical database cluster. The security policy mandates that known exploit payloads must be actively blocked in real time before reaching internal targets, and any hardware or software failure of the security device must not disrupt legitimate network traffic flow. Which deployment topology and detection mechanism best satisfies all of these requirements?

  1. Deploy an in-band Network Intrusion Prevention System (NIPS) using signature-based detection paired with a hardware fail-open bypass switch.Cevap
  2. B
    Deploy an out-of-band Network Intrusion Detection System (NIDS) connected to a switch SPAN port operating at Layer 2 to drop malicious frames in real time.
  3. C
    Deploy an inline Network Intrusion Prevention System (NIPS) utilizing anomaly-based detection configured to inspect incoming traffic strictly on port 23.
  4. D
    Deploy a Host Intrusion Detection System (HIDS) on the perimeter router to analyze overall network traffic streams for known attack vectors.

Cevap

The optimal solution is to deploy an in-band Network Intrusion Prevention System (NIPS) using signature-based detection combined with a hardware fail-open bypass switch.
An in-band (inline) Network Intrusion Prevention System (NIPS) sits directly in the data communication path, giving it the ability to inspect and drop malicious packets before they reach destination targets. Signature-based detection allows immediate identification of established exploit patterns with high accuracy. Adding a hardware bypass switch ensures high availability by allowing traffic to flow unhindered (fail-open) if the inline device encounters engine or hardware failure.

Adım Adım Çözüm

1
Analyze placement requirements for active real-time traffic remediation.
Real-time blocking requires an in-band (inline) NIPS so packets traverse the security engine directly before reaching the destination.
Out-of-band (passive) solutions like SPAN/TAP NIDS receive copied traffic and can only send alerts or TCP resets after traffic has passed.
2
Determine the appropriate detection engine mechanism for known exploit patterns.
Signature-based detection matches specific, known exploit payload strings efficiently and reliably without baseline training periods.
Anomaly-based detection relies on baseline deviations and has higher false-positive rates for established, well-defined exploit signatures.
3
Address high availability and continuous uptime constraints.
A hardware bypass (fail-open) switch ensures that if the NIPS appliance loses power or crashes, inline network connectivity remains open.
Without a fail-open mechanism, an inline NIPS failure would cause a complete network outage (fail-closed).

Anahtar Kavram

NIPS Inline Deployment Topology and High Availability Mechanisms
Bu soruyu puanla

Konular

Intrusion Detection and Prevention Systems (IDS/IPS)

Bu konudan daha fazla soru