The IT manager is evaluating IPS products to determine which would be most effective at stopping network traffic that contains anomalous content on networks that carry very specific types of…

Question

Options

• ASignature-based
• BRate-based
• CAnomaly-based
• DHost-based

• A
  73% (27)
• B
  3% (1)
• C
  8% (3)
• D
  16% (6)

Explanation

This is a nuanced question. Because the network carries 'very specific types of traffic,' the traffic profile is highly predictable and well-defined. Signature-based IPS is best suited here because: (1) when legitimate traffic is well-known and highly specific (e.g., a SCADA/ICS network or a single-purpose financial transaction network), precise signatures can be written for every expected protocol and transaction type; (2) anything that doesn't match a valid signature is blocked - this is essentially a default-deny posture built on known-good signatures; (3) signature-based IPS has very low false positives when applied to constrained, well-understood traffic. Anomaly-based IPS (C) builds a behavioral baseline - useful for general-purpose networks where you cannot enumerate all valid traffic, but less precise on specialized networks where exact signatures are achievable. Rate-based IPS (B) targets volumetric/DoS attacks. Host-based IPS (D) protects individual hosts, not network segments.

No community discussion yet for this question.