CA1-005: CompTIA SecurityXDemo

By CompTIA · Question Mode

QuestionQ85

Security Architecture

A company deployed a NIDS and a NIPS in its most critical environments. Since the deployment, the company has experienced network-connectivity problems. Which of the following should the security architect recommend for a new NIDS/NIPS deployment?

  • A Implementing the NIDS with a port mirror in the core switch and the NIPS in the main firewall
  • B Implementing the NIDS and the NIPS together with the main firewall
  • C Implementing a NIDS without a NIPS to increase the detection capability
  • D Implementing the NIDS in the bastion host and the NIPS in the branch network router
Explanation

A NIDS can passively inspect a copy of traffic from a core-switch mirror (SPAN) port, leaving the original traffic flow uninterrupted. A NIPS must be deployed inline to block malicious traffic, and the main firewall is an appropriate central enforcement point. Cisco documents that SPAN duplicates traffic for a monitoring device while the original traffic continues on its intended path, and that inline deployments can block traffic.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!