Soru

Zorluk: KolayNetwork Security Monitoring and Alerting

A security technician is deploying monitoring sensors across an enterprise network. Which of the following statements correctly describe the features and operational behavior of a passive Network Intrusion Detection System (NIDS)? (Select TWO.)

  1. It analyzes mirrored network traffic from a switch port without introducing latency to live network packets.Cevap
  2. It generates security alerts upon detecting signature matches but does not actively stop or alter packets in transit.Cevap
  3. C
    It sits inline within the network traffic flow to automatically drop unauthorized TCP packets before reaching their destination.
  4. D
    It inspects and rewrites SQL injection payloads inside incoming web request bodies to prevent database execution.

Cevap

The correct options state that a passive Network Intrusion Detection System (NIDS) analyzes mirrored network traffic without introducing latency to live packets and generates security alerts without actively stopping or altering traffic in transit.
A passive Network Intrusion Detection System (NIDS) operates out-of-band by analyzing duplicated network traffic (such as traffic provided by SPAN ports or network TAPs). Because it processes copies of packets out-of-band, it does not add latency to production traffic flows and acts as a detective control by generating alerts when malicious signatures are matched, without interrupting packet transit.

Adım Adım Çözüm

1
Identify the operational placement of a passive Network Intrusion Detection System (NIDS).
A passive NIDS is deployed out-of-band, receiving duplicated traffic from TAP or SPAN/mirror ports.
Out-of-band deployment ensures that monitoring activities do not add latency to active network communications.
2
Determine the control function and capabilities of a passive monitoring solution.
Passive NIDS devices act as detective controls by analyzing traffic against known signature sets and alerting administrators.
Since the NIDS receives copied packets out-of-band, it lacks inline capability to modify or drop malicious network traffic directly.

Anahtar Kavram

Passive Out-of-Band Network Intrusion Detection
Bu soruyu puanla