A logistic company must use an outdated application located in a private VLAN during the migration to new technologies. The IPS blocked and reported an unencrypted communication. Which tuning option…

Restricting the allow list to only authorized source hosts contacting the application's specific IP address on a specific port applies the principle of least privilege to IPS tuning. This approach minimizes the attack surface by ensuring only known, approved systems can communicate with the legacy application over the required unencrypted channel. Scoping by both source identity and destination port prevents unauthorized lateral movement while enabling the required business functionality.

Allowing all HTTP traffic through corporate VLANs is excessively broad and violates least privilege by permitting unencrypted traffic from any host on any VLAN to any destination.

Allowing traffic from the entire internal network to the application's IP at a specific port is too permissive because it does not restrict by authorized source host, meaning any internal device could reach the legacy application.

Allow listing traffic to the application's VLAN is overly broad because it targets an entire network segment rather than the specific application IP and port, potentially exposing other hosts within that VLAN.