A network administrator is implementing an IPS on VLAN 1 and wants the IPS to learn what to prevent on its own. Which of the following would MOST likely be installed?

The correct answer is C. Behavior based IPS. A behavior-based (also called anomaly-based) IPS establishes a baseline of normal network activity and then detects deviations from that baseline - it effectively 'learns' what is normal and flags what is not. This is the 'learns on its own' capability the question describes. A…

Network security

Question

Options

AHoneynet
BSignature based IPS
CBehavior based IPS
DHost based IPS

How the community answered

(32 responses)

B
3% (1)
C
94% (30)
D
3% (1)

Explanation

A behavior-based (also called anomaly-based) IPS establishes a baseline of normal network activity and then detects deviations from that baseline - it effectively 'learns' what is normal and flags what is not. This is the 'learns on its own' capability the question describes. A signature-based IPS relies on a predefined database of known attack patterns and cannot learn new threats autonomously. A honeynet is a decoy network used to observe attacker behavior, not a prevention system. A host-based IPS (HIPS) is installed on individual endpoints, not on a VLAN at the network level.

Topics

#IPS#behavior-based detection#anomaly detection#intrusion prevention

Community Discussion

No community discussion yet for this question.

Full N10-005 Practice