210-250 · Question #87
Which actions can a promiscuous IPS take to mitigate an attack?
The correct answer is B. requesting connection blocking D. resetting the TCP connection E. requesting host blocking. A promiscuous (out-of-band) IPS monitors a copy of traffic and cannot directly intercept packets, so its mitigation actions are indirect.
Question
Which actions can a promiscuous IPS take to mitigate an attack?
Options
- Amodifying packets
- Brequesting connection blocking
- Cdenying packets
- Dresetting the TCP connection
- Erequesting host blocking
- Fdenying frames
How the community answered
(53 responses)- A2% (1)
- B85% (45)
- C8% (4)
- F6% (3)
Why each option
A promiscuous (out-of-band) IPS monitors a copy of traffic and cannot directly intercept packets, so its mitigation actions are indirect.
Modifying packets requires inline placement in the traffic path; a promiscuous IPS only receives a copy of traffic and cannot alter the original packets.
A promiscuous IPS can send a request to a firewall or router to block a connection since it cannot block traffic directly.
Directly denying packets requires the IPS to be deployed inline so it can drop traffic in real time, which is not the case for a promiscuous mode deployment.
A promiscuous IPS can send TCP RST packets to both endpoints to tear down a malicious TCP session, which is an indirect mitigation technique.
A promiscuous IPS can request that a firewall or access control device block all traffic from a specific host identified as malicious.
Denying frames operates at Layer 2 and requires inline interception capability, which a promiscuous IPS does not have.
Concept tested: Promiscuous IPS mitigation capabilities and limitations
Source: https://www.cisco.com/c/en/us/td/docs/security/ips/7-0/configuration/guide/idm/idmguide7/idm_sig_events.html
Topics
Community Discussion
No community discussion yet for this question.