Examkin

Soru

Zorluk: Çok zorIntrusion Detection and Prevention Systems (IDS/IPS)

A network security engineer is designing an intrusion prevention architecture for a high-frequency trading firm's REST API gateway. The gateway receives TLS 1.3 encrypted HTTP/2 traffic routed asymmetrically across dual active-active Internet edge links. The firm requires active, real-time blocking of unknown zero-day application exploits, strict adherence to sub-millisecond added network latency limits (<1 ms< 1\text{ ms}), and complete protection against session dropping caused by asymmetric TCP packet paths. Which deployment model and inspection mechanism best fulfills all system requirements?

  1. Deploy a Host-based Intrusion Prevention System (HIPS) running an anomaly-based detection engine directly on the API gateway servers.Cevap
  2. B
    Deploy a passive Network Intrusion Detection System (NIDS) connected via SPAN ports on both border switches using a signature-based detection engine.
  3. C
    Deploy inline Network Intrusion Prevention System (NIPS) appliances on each edge link operating with signature-based detection without state synchronization.
  4. D
    Deploy a network TAP array mirroring encrypted port 443 traffic directly to a centralized Security Information and Event Management (SIEM) system for automated rule blocking.

Cevap

Deploying a Host-based Intrusion Prevention System (HIPS) utilizing an anomaly-based detection engine directly on the host API gateway servers is the optimal solution.
Deploying a Host-based Intrusion Prevention System (HIPS) directly on the API gateway hosts solves all technical challenges simultaneously. Because HIPS operates at the operating system/application level on the endpoint, it inspects network traffic after TLS decryption occurred. Furthermore, host placement eliminates external network inline latency and avoids TCP session corruption caused by asymmetric routing across dual ISP links. Utilizing an anomaly-based detection engine allows the system to detect and actively prevent zero-day exploits by identifying deviations from baseline behavior rather than relying on known signatures.

Adım Adım Çözüm

1
Analyze asymmetric routing and network latency constraints.
Inline network appliances (NIPS) placed across active-active links suffer from state asymmetry unless synchronized across links, and introduce additional inline interface processing latency. Host-based placement (HIPS) eliminates external network-hop latency and avoids asymmetric network routing state mismatches altogether.
Host systems reassemble TCP segments locally after network routing delivers packets, rendering network asymmetry irrelevant to host-level security engines.
2
Evaluate payload encryption requirements (TLS 1.3).
Network-level sensors (NIDS/NIPS) placed before SSL/TLS termination cannot inspect encrypted HTTP/2 payload contents without complex SSL decryption proxies that add latency. HIPS operates post-decryption inside the host network stack/application layer.
Inspecting encrypted payloads requires access to the cleartext stream, which is naturally available at the host application endpoint.
3
Match detection engine logic to the threat model (zero-day exploits).
Signature-based engines depend on known exploit patterns and fail to identify novel zero-day attacks. Anomaly/behavioral-based engines establish a baseline of normal behavior and flag or block novel deviations.
Zero-day vulnerability attacks lack pre-existing signatures, making anomaly-based or heuristic detection mandatory for active prevention.

Anahtar Kavram

Host-based IPS (HIPS) vs Network-based IPS (NIPS) placement trade-offs regarding payload encryption, asymmetric routing, and anomaly vs signature detection engines.
Bu soruyu puanla

Konular

Intrusion Detection and Prevention Systems (IDS/IPS)

Bu konudan daha fazla soru