What added enforcement feature is available on IDS-based devices to terminate active malicious traffic?

The correct answer is B. TCP reset. Traditional IDS (Intrusion Detection System) devices operate in passive/promiscuous mode and cannot block traffic inline. However, they can terminate active TCP sessions by injecting TCP RST (reset) packets to both the source and destination of a malicious connection. This TCP…

Security Services

Question

Options

ASignature detection
BTCP reset
CSNMP alert
DLayer 4 filtering

How the community answered

(26 responses)

B
88% (23)
C
4% (1)
D
8% (2)

Explanation

Traditional IDS (Intrusion Detection System) devices operate in passive/promiscuous mode and cannot block traffic inline. However, they can terminate active TCP sessions by injecting TCP RST (reset) packets to both the source and destination of a malicious connection. This TCP reset capability is the primary active enforcement mechanism available to IDS-based devices without requiring them to be inline. Signature detection is a detection method, not enforcement. SNMP alerts are notifications only. Layer 4 filtering is an IPS/firewall function, not an IDS feature.

Topics

#IDS#TCP reset#intrusion detection#malicious traffic termination

Community Discussion

No community discussion yet for this question.

Full 300-320 Practice