A company is planning to deploy an in-house Security Operations Center (SOC). One of the new requirements is to deploy a NIPS solution into the Internet facing environment. The SOC highlighted the…

Question

Options

• AIn front of the Internet firewall and in front of the DMZs
• BIn front of the Internet firewall and in front of the internal firewall
• CIn front of the Internet firewall and behind the internal firewall
• DBehind the Internet firewall and in front of the DMZs

• A
  66% (23)
• B
  6% (2)
• C
  20% (7)
• D
  9% (3)

Explanation

The two SOC requirements dictate two distinct NIPS placements. First, 'fingerprinting on unfiltered inbound traffic' requires a NIPS sensor placed in front of (outside) the Internet-facing firewall, where traffic has not yet been filtered or altered by firewall rules. Second, 'monitoring all inbound and outbound traffic to the DMZs' requires a NIPS placed in front of (at the edge of) each DMZ segment. Option A satisfies both: one sensor outside the firewall for raw fingerprinting and one in front of the DMZs for full DMZ traffic visibility. Options B and C misplace the second sensor relative to the internal network rather than the DMZs. Option D places both sensors after the firewall, missing unfiltered traffic.

No community discussion yet for this question.