CAS-002 · Question #692
A small bank is introducing online banking to its customers through its new secured website. The firewall has three interfaces: one for the Internet connection, another for the DMZ, and the other…
The correct answer is C. Implement host intrusion prevention on all machines at the bank. Host intrusion prevention deployed on every machine provides the broadest defense-in-depth coverage because it protects each endpoint regardless of attack origin or vector.
Question
A small bank is introducing online banking to its customers through its new secured website. The firewall has three interfaces: one for the Internet connection, another for the DMZ, and the other for the internal network. Which of the following will provide the MOST protection from all likely attacks on the bank?
Options
- AImplement NIPS inline between the web server and the firewall.
- BImplement a web application firewall inline between the web server and the firewall.
- CImplement host intrusion prevention on all machines at the bank.
- DConfigure the firewall policy to only allow communication with the web server using SSL.
How the community answered
(27 responses)- A4% (1)
- B11% (3)
- C63% (17)
- D22% (6)
Why each option
Host intrusion prevention deployed on every machine provides the broadest defense-in-depth coverage because it protects each endpoint regardless of attack origin or vector.
A network IPS inline between only the web server and the firewall leaves all other network segments and internal machines unprotected from attack.
A web application firewall only protects against application-layer HTTP/S attacks targeting the web server and does not address network-level, insider, or non-web attack vectors.
Host-based intrusion prevention systems (HIPS) installed on all machines monitor and block malicious activity at the endpoint level, covering both inbound attacks and insider threats that bypass network-layer controls. This approach protects all machines in the bank, not just the web server, and addresses the widest range of attack scenarios including those that originate internally or traverse encrypted channels.
Restricting firewall policy to SSL only enforces encrypted transport but does not inspect or block malicious content within SSL sessions or attacks originating from inside the network.
Concept tested: Host-based intrusion prevention for comprehensive endpoint defense
Source: https://csrc.nist.gov/publications/detail/sp/800-94/final
Topics
Community Discussion
No community discussion yet for this question.