nerdexam
GIAC

GCIA · Question #74

You work as a Network Administrator in a company. The NIDS is implemented on the network. You want to monitor network traffic. Which of the following modes will you configure on the network…

The correct answer is A. Promiscuous. A NIC configured in promiscuous mode captures all packets on the network segment, which is required for a NIDS sensor to monitor traffic not addressed directly to the sensor host.

Intrusion Detection System (IDS) Fundamentals & Snort Rules

Question

You work as a Network Administrator in a company. The NIDS is implemented on the network. You want to monitor network traffic. Which of the following modes will you configure on the network interface card to accomplish the task?

Options

  • APromiscuous
  • BAudit mode
  • CFull Duplex
  • DHalf duplex

How the community answered

(33 responses)
  • A
    79% (26)
  • B
    6% (2)
  • C
    3% (1)
  • D
    12% (4)

Why each option

A NIC configured in promiscuous mode captures all packets on the network segment, which is required for a NIDS sensor to monitor traffic not addressed directly to the sensor host.

APromiscuousCorrect

Promiscuous mode disables the NIC's default behavior of silently discarding frames not addressed to its own MAC address, allowing it to forward all captured frames to the OS for inspection. This is essential for NIDS operation because the sensor must analyze all traffic flowing through the segment, not just traffic explicitly destined for the sensor itself.

BAudit mode

Audit mode is not a recognized NIC operating mode and has no effect on whether the interface captures traffic beyond its assigned MAC address.

CFull Duplex

Full duplex is a link-level transmission setting that enables simultaneous send and receive, but it does not control whether the NIC processes frames addressed to other hosts.

DHalf duplex

Half duplex restricts transmission to one direction at a time and has no bearing on the NIC's ability to capture all traffic on a segment for monitoring purposes.

Concept tested: NIC promiscuous mode for NIDS traffic capture

Source: https://docs.snort.org/start/installation

Topics

#promiscuous mode#NIDS#NIC configuration#network monitoring

Community Discussion

No community discussion yet for this question.

Full GCIA Practice