A company has been running Gateway IDS/IPS on its gateways in IDS mode for several weeks. The company wants to transition to IPS mode. What is one step you should recommend?

Question

Options

• ADisable traffic inspection and reboot before re-enabling traffic inspection with the new mode.
• BChange the mode on one gateway at a time to establish a smoother transition period.
• CConsider applying a stricter IPS policy to minimize issues during the transition period.
• DCheck for legitimate traffic that has been flagged as a threat and allow list the associated rules.

• A
  12% (5)
• B
  22% (9)
• C
  5% (2)
• D
  61% (25)

Explanation

When transitioning from Intrusion Detection System (IDS) mode to Intrusion Prevention System (IPS) mode, it's critical to review and refine configurations to ensure legitimate traffic is not In IDS mode, the system only detects and logs suspicious traffic but does not block it. Reviewing these logs for false positives allows the organization to fine-tune policies and allow list legitimate traffic before transitioning to IPS mode. By doing this, the company ensures that IPS mode will block actual threats while permitting legitimate traffic. This is a proactive step to prevent unnecessary disruptions to normal operations when IPS mode

No community discussion yet for this question.