A security team is evaluating the operational differences between placing a Network Intrusion Detection System (NIDS) passively via a switch SPAN port versus deploying a Network Intrusion Prevention System (NIPS) inline. Which of the following statements accurately describe these deployment models? (Select TWO.)
- Inline NIPS placement allows the security appliance to actively stop threat vectors by dropping malicious packets in real time.Cevap
- Passive NIDS monitoring via a SPAN port inspects mirrored network traffic without adding inline latency to production network traffic.Cevap
- CPassive NIDS connected to a SPAN port operates purely at Layer 2 to physically block rogue packets before they reach destination network interfaces.
- DInline NIPS deep packet inspection requires target network streams to be directed exclusively to TCP port 22 for packet analysis.
Cevap
The statement explaining that inline NIPS placement actively drops malicious packets in real time, along with the statement indicating that passive NIDS monitoring via a SPAN port inspects copied traffic without adding latency, are both correct.
Inline NIPS devices sit directly within the communication stream, enabling active packet drops upon detecting malicious traffic. Conversely, passive NIDS deployment receives mirrored traffic via switch SPAN ports, providing threat detection visibility without introducing inline processing latency.
Adım Adım Çözüm
Anahtar Kavram
In-band inline prevention versus out-of-band passive detection deployment models.