nerdexam
Cisco

352-001 · Question #378

On a large enterprise security solution, which two options are IDS or IPS modes of operation? (Choose two.)

The correct answer is B. promiscuous mode E. inline mode. IDS and IPS sensors operate in two primary deployment modes - promiscuous mode for passive detection and inline mode for active prevention.

Designing Security

Question

On a large enterprise security solution, which two options are IDS or IPS modes of operation? (Choose two.)

Options

  • Atransparent mode
  • Bpromiscuous mode
  • Ctraffic discovery mode
  • Drouted mode
  • Einline mode

How the community answered

(66 responses)
  • A
    5% (3)
  • B
    86% (57)
  • C
    8% (5)
  • D
    2% (1)

Why each option

IDS and IPS sensors operate in two primary deployment modes - promiscuous mode for passive detection and inline mode for active prevention.

Atransparent mode

Transparent mode is a Layer 2 bridging deployment mode used by firewalls, not a defined operational mode for IDS or IPS sensors.

Bpromiscuous modeCorrect

Promiscuous mode is the standard IDS deployment where the sensor receives a copy of traffic via a SPAN port or network tap, operating entirely out-of-band so it can analyze and alert on threats without affecting the traffic flow.

Ctraffic discovery mode

Traffic discovery mode is not a recognized or standardized IDS/IPS operational mode in any major vendor architecture.

Drouted mode

Routed mode is a Layer 3 forwarding mode associated with firewalls such as the Cisco ASA, not a mode of operation defined for IDS or IPS devices.

Einline modeCorrect

Inline mode is the standard IPS deployment where the sensor is inserted directly into the traffic path between network segments, enabling real-time packet inspection and the ability to actively drop or modify malicious traffic before it reaches its destination.

Concept tested: IDS and IPS sensor operational deployment modes

Source: https://www.cisco.com/c/en/us/td/docs/security/ips/7-0/configuration/guide/idm/idmguide7/idm_sensor_mode.html

Topics

#IDS#IPS#promiscuous mode#inline mode

Community Discussion

No community discussion yet for this question.

Full 352-001 Practice