nerdexam
Cisco

352-001 · Question #506

Which statement about IDS/IPS design is correct?

The correct answer is C. An IDS analyzes a copy of the monitored traffic and not the actual forwarded packet.. An IDS operates in passive mode and analyzes a copy of network traffic, while an IPS is deployed inline and can act on the actual forwarded packets. Confusing which device operates inline versus out-of-band is a common design error.

Designing Security

Question

Which statement about IDS/IPS design is correct?

Options

  • AAn IPS analyzes a copy of the monitored traffic and not the actual forwarded packet.
  • BAn IPS should be deployed if the security policy does not support the denial of traffic.
  • CAn IDS analyzes a copy of the monitored traffic and not the actual forwarded packet.
  • DBandwidth considerations must be taken into account since IDS is deployed inline to traffic flow.

How the community answered

(41 responses)
  • A
    10% (4)
  • B
    2% (1)
  • C
    85% (35)
  • D
    2% (1)

Why each option

An IDS operates in passive mode and analyzes a copy of network traffic, while an IPS is deployed inline and can act on the actual forwarded packets. Confusing which device operates inline versus out-of-band is a common design error.

AAn IPS analyzes a copy of the monitored traffic and not the actual forwarded packet.

This statement describes the behavior of an IDS (copy of traffic, not inline), but incorrectly attributes it to an IPS, which actually processes the original forwarded packet inline.

BAn IPS should be deployed if the security policy does not support the denial of traffic.

If a security policy does not support denying traffic, an IDS should be deployed instead of an IPS, because an IPS is specifically designed to drop or block traffic.

CAn IDS analyzes a copy of the monitored traffic and not the actual forwarded packet.Correct

An IDS uses a promiscuous or SPAN-based deployment where it receives a mirrored copy of traffic; because it never sits in the forwarding path, it can only detect and alert, not block, making this statement technically accurate.

DBandwidth considerations must be taken into account since IDS is deployed inline to traffic flow.

It is the IPS, not the IDS, that is deployed inline to the traffic flow; bandwidth considerations apply to inline IPS deployments, not to out-of-band IDS deployments.

Concept tested: IDS vs IPS inline vs out-of-band deployment modes

Source: https://www.cisco.com/c/en/us/td/docs/security/ips/7-0/configuration/guide/idm/idmguide7/ovrvw_sys.html

Topics

#IDS#IPS#inline deployment#traffic monitoring

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 352-001 Practice