Which two statements correctly describe an IPS device? (Choose two.)

Question

Options

• AIt resembles a Layer 2 bridge.
• BTraffic flow through the IPS resembles traffic flow through a Layer 3 router.
• CInline interfaces which have no IP addresses cannot be detected.
• DMalicious packets that have been detected are allowed to pass through, but all subsequent traffic
• ETraffic arrives on the detection interface, is inspected, and exits via the same interface.

• A
  87% (48)
• B
  4% (2)
• D
  7% (4)
• E
  2% (1)

Explanation

A is correct: An inline IPS operates transparently at Layer 2, forwarding frames between its inline interface pair much like a bridge - it does not route traffic and does not require IP addresses on its sensing interfaces. C is correct: Because the inline interfaces have no IP addresses (and no associated IP stack), they are not reachable by attackers. A port scan or ping sweep will not detect them, making the IPS effectively invisible on the network - a key security advantage. B is incorrect because the IPS resembles a Layer 2 bridge, not a Layer 3 router. D is incorrect because an inline IPS drops malicious packets immediately; it does not allow them to pass through. E is incorrect because in inline mode, traffic enters on one interface and exits on the paired interface (not the same interface) - that would describe a promiscuous/SPAN-based deployment, which is detection-only, not inline.

No community discussion yet for this question.