GSLC · Question #266
You work as a Network Administrator in a company. The NIDS is implemented on the network. You want to monitor network traffic. Which of the following modes will you configure on the network interface
The correct answer is B. Promiscuous. Promiscuous mode configures a NIC to capture all packets on the network segment, which is required for a NIDS to inspect traffic not addressed to its own MAC address.
Question
You work as a Network Administrator in a company. The NIDS is implemented on the network. You want to monitor network traffic. Which of the following modes will you configure on the network interface card to accomplish the task?
Options
- AHalf duplex
- BPromiscuous
- CFull Duplex
- DAudit mode
How the community answered
(64 responses)- A2% (1)
- B89% (57)
- C6% (4)
- D3% (2)
Why each option
Promiscuous mode configures a NIC to capture all packets on the network segment, which is required for a NIDS to inspect traffic not addressed to its own MAC address.
Half duplex is a transmission mode describing one-directional-at-a-time communication and has no effect on which packets the NIC captures.
In promiscuous mode, the NIC passes all received frames up the network stack regardless of the destination MAC address, allowing NIDS software to analyze every packet traversing the segment rather than only those destined for that host.
Full duplex is a transmission mode allowing simultaneous send and receive; it does not affect packet capture scope on the NIC.
Audit mode is an operating system or policy concept (e.g., Windows audit policy) and is not a configurable NIC mode for traffic capture.
Concept tested: NIC promiscuous mode for network intrusion detection
Source: https://www.cisco.com/c/en/us/td/docs/security/ips/7-0/configuration/guide/cli/cliguide7/cli_interfaces.html
Topics
Community Discussion
No community discussion yet for this question.