A network security architect is designing an enterprise monitoring and threat mitigation strategy. Match each intrusion detection/prevention deployment model on the left with its corresponding technical implementation characteristic on the right.
- Inline NIPS with Signature-Based EngineActively inspects transit packets to drop known CVE attack payloads directly in the traffic flow, introducing minor latency.
- Passive Out-of-Band NIDS via Hardware TAPReceives physical bit-level packet copies to detect exploits without introducing a single point of network failure or transit delay.
- Host-Based IPS (HIPS) with Behavior AnalysisEvaluates local OS API calls and system process memory usage on an endpoint to terminate unapproved zero-day actions.
- Anomaly-Based NIDS with Baseline MonitoringCompares real-time network traffic metrics against established statistical profiles to flag unexpected protocol spikes or volume shifts.
Cevap
Inline NIPS with Signature-Based Engine matches active packet dropping of known CVE payloads in transit. Passive Out-of-Band NIDS via Hardware TAP matches receiving physical packet copies without latency or single-point-of-failure risks. Host-Based IPS (HIPS) with Behavior Analysis matches local OS API call and memory evaluation to stop zero-day execution. Anomaly-Based NIDS with Baseline Monitoring matches comparing live metrics against statistical profiles to detect unusual protocol shifts.
Each architecture correctly pairs placement with detection engine capabilities: Inline NIPS actively drops known signature matches in-band; Hardware TAPs feed passive out-of-band monitoring without latency or failure risks; HIPS monitors local endpoint process memory and system calls; Anomaly-based NIDS flags traffic metric deviations against established statistical baselines.
Adım Adım Çözüm
Anahtar Kavram
Intrusion Detection and Prevention Systems (IDS/IPS) Topologies and Detection Engines