A financial company implements end-to-end encryption via SSL in the DMZ, and only IPSec in transport mode with AH enabled and ESP disabled throughout the internal network. The company has hired a…

Question

Options

• ASwitch to TLS in the DMZ. Implement NIPS on the internal network, and HIPS on the DMZ.
• BSwitch IPSec to tunnel mode. Implement HIPS on the internal network, and NIPS on the
• CDisable AH. Enable ESP on the internal network, and use NIPS on both networks.
• DEnable ESP on the internal network, and place NIPS on both networks.

• A
  63% (22)
• B
  20% (7)
• C
  11% (4)
• D
  6% (2)

Explanation

Two issues exist: (1) SSL is deprecated and should be replaced with TLS in the DMZ. (2) On the internal network, IPSec is using AH (Authentication Header) only - AH authenticates packets but does NOT encrypt them. Because internal traffic is unencrypted, a Network IPS (NIPS) can inspect it for threats, making NIPS appropriate there. In the DMZ, TLS encrypts traffic end-to-end, so a NIPS cannot inspect the payload; a Host-based IPS (HIPS) operates on the host where traffic is decrypted, making it effective there. Option B reverses the IPS placement incorrectly. Option C disables AH (removing authentication). Option D enables ESP internally, which would encrypt traffic and prevent NIPS from inspecting it.

No community discussion yet for this question.