IPS devices work based on specific intrusion prevention mechanisms. Which of the following is the correct ranking of intrusion prevention mechanisms?

Question

Options

• AFeature matching->Reorganize application data->Protocol identification and protocol
• BReorganize application data->Protocol identification and protocol parsing->Feature
• CReorganize application data->Feature matching->Protocol identification and protocol
• DProtocol identification and protocol parsing->Reorganize application data->Feature

• A
  2% (1)
• B
  82% (45)
• C
  11% (6)
• D
  5% (3)

Explanation

Option B is correct because IPS mechanisms must follow a logical data processing pipeline: raw network traffic arrives fragmented and out-of-order, so data reorganization (reassembly/defragmentation) must happen first before any meaningful analysis is possible. Only after the data stream is complete can the IPS perform protocol identification and parsing to understand the application-layer context (e.g., HTTP, FTP, SMTP). Finally, with clean, protocol-decoded data, the IPS can efficiently run feature/signature matching to detect attack patterns.

Options A and C are wrong because they place feature matching before protocol identification - you cannot reliably match attack signatures without first understanding the protocol structure, as the same bytes mean different things in different protocols. Option D fails because it attempts protocol identification on raw, potentially fragmented data, which produces unreliable results - you must reassemble the stream first.

Memory tip: Think of it as the "3 Rs" in order - Rebuild → Read → Recognize (Reorganize the data → Read the protocol → Recognize the threat signatures).

No community discussion yet for this question.