Examkin

Soru

Zorluk: KolayIntrusion Detection and Prevention Systems (IDS/IPS)

A network security administrator needs to deploy a security solution that sits directly in the traffic path to inspect incoming packets and actively block identified threats in real time before they reach internal hosts. Which of the following devices should the administrator implement?

  1. Network Intrusion Prevention System (NIPS) placed inlineCevap
  2. B
    Network Intrusion Detection System (NIDS) connected to a switch SPAN port
  3. C
    Protocol analyzer installed on a mirrored port interface
  4. D
    Host-based Antivirus engine examining local system file integrity

Cevap

Network Intrusion Prevention System (NIPS) placed inline
An inline Network Intrusion Prevention System (NIPS) processes traffic directly in the flow path, enabling automated real-time threat detection and packet drop actions before malicious traffic reaches target nodes.

Adım Adım Çözüm

1
Identify the primary functional requirement
The requirement demands active real-time inspection and automated packet dropping/blocking of malicious network traffic.
Preventative controls must operate in-band (inline) to intercept traffic prior to reaching target systems.
2
Compare passive (detection) versus active (prevention) network monitoring mechanisms
Passive systems (NIDS/SPAN) inspect copied frames out-of-band and generate alerts without inline blocking capability, while active systems (NIPS) sit in-line to enforce packet drop actions.
Inline deployment allows the security appliance to pass or stop live traffic dynamically.

Anahtar Kavram

Intrusion Prevention Systems (IPS) operate inline to actively block detected threats in real time, whereas Intrusion Detection Systems (IDS) operate passively out-of-band to monitor and alert.
Bu soruyu puanla

Konular

Intrusion Detection and Prevention Systems (IDS/IPS)

Bu konudan daha fazla soru