Examkin

Soru

Zorluk: OrtaIntrusion Detection and Prevention Systems (IDS/IPS)

A network security administrator is deploying a Network Intrusion Detection System (NIDS) connected to a hardware network TAP at the main datacenter perimeter. Which of the following operational characteristics and limitations apply specifically to this out-of-band NIDS architecture? (Select TWO).

  1. The deployment introduces zero processing latency to the active transit traffic flow.Cevap
  2. The system cannot directly block or drop malicious packets before they reach their destination host.Cevap
  3. C
    The monitoring sensor becomes a single point of failure that halts all network throughput if the sensor service crashes.
  4. D
    The appliance decrypts Layer 7 HTTPS payload contents automatically without host-based certificate access.

Cevap

The out-of-band NIDS deployment introduces zero processing latency to live transit traffic and cannot directly drop or block malicious packets inline before they reach their destination.
Out-of-band NIDS sensors receive duplicate frames via SPAN or network TAPs. Because the sensor operates outside the live packet path, it does not add latency to transit traffic, but it also lacks the ability to prevent or drop malicious packets inline before they arrive at their destination.

Adım Adım Çözüm

1
Analyze the deployment architecture described in the scenario.
The scenario specifies a passive out-of-band NIDS receiving mirrored traffic from a hardware network TAP.
Placement topology dictates whether the system functions inline (in-band) or passively (out-of-band).
2
Evaluate the latency impact of passive monitoring.
Since packets are copied by the TAP and sent to the NIDS in parallel, original transit frames are not delayed.
Out-of-band sensors process copies of packets rather than sitting directly in the active data path.
3
Evaluate active prevention capabilities of passive monitoring.
Because the sensor sits outside the live path, it can generate alerts or send TCP resets, but it cannot drop inline packets in real time.
Inline drop actions require in-band NIPS placement directly between the source and destination.

Anahtar Kavram

Out-of-Band NIDS Architecture vs. Inline NIPS Placement
Bu soruyu puanla

Konular

Intrusion Detection and Prevention Systems (IDS/IPS)

Bu konudan daha fazla soru