GSLC · Question #137
You are the Network Administrator for a large corporate network. You want to monitor all network traffic on your local network for suspicious activities and receive a notification when a possible…
The correct answer is D. Install a network-based IDS. A network-based IDS (NIDS) is the correct choice because the goal is to monitor ALL traffic traversing the local network segment, not just activity on a single machine. A NIDS is deployed at strategic points in the network (e.g., behind the perimeter firewall) where it can…
Question
You are the Network Administrator for a large corporate network. You want to monitor all network traffic on your local network for suspicious activities and receive a notification when a possible attack is in process. Which of the following actions will you take for this?
Options
- AInstall a host-based IDS
- BEnable verbose logging on the firewall
- CInstall a DMZ firewall
- DInstall a network-based IDS
How the community answered
(32 responses)- A6% (2)
- B3% (1)
- C3% (1)
- D88% (28)
Explanation
A network-based IDS (NIDS) is the correct choice because the goal is to monitor ALL traffic traversing the local network segment, not just activity on a single machine. A NIDS is deployed at strategic points in the network (e.g., behind the perimeter firewall) where it can passively capture and analyze all passing packets, detecting patterns that match known attack signatures and alerting administrators in real time. A host-based IDS (Option A) only monitors the single host it is installed on, so it would miss traffic between other devices. Enabling verbose firewall logging (Option B) records connection attempts but does not actively analyze traffic for attack patterns or generate real-time alerts. A DMZ firewall (Option C) is an architectural control that segments networks but provides no traffic analysis or intrusion detection capability.
Topics
Community Discussion
No community discussion yet for this question.