4.4 Compare Inline Traffic Interrogation and Taps or Traffic Monitoring 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A large enterprise is designing a security monitoring architecture. The security team wants to inspect all east-west traffic between application tiers. The network team is concerned about the performance impact of inline inspection on application response times. The compliance team requires that all traffic be logged for at least one year. Which architecture best balances these concerns?

   • AUse a combination of inline IPS for critical tiers and passive taps for less critical tiers, with centralized logging
   • BDeploy an inline IPS between every application tier and log all traffic to a central SIEM
   • CUse NetFlow export from all switches and store flow logs
   • DUse passive taps on the links between tiers and send copies to an IDS and a packet capture system
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does passive traffic monitoring capture traffic?

   • ABy using a TAP or switch SPAN port to receive a copy of the traffic without being in the data path.
   • BBy placing the monitoring device in the data path so all traffic must pass through it.
   • CBy analyzing router logs after the traffic has been forwarded.
   • DBy intercepting traffic at the application layer using a proxy.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team wants to analyze network traffic patterns over a month to identify potential data exfiltration. The analysis must not affect network performance and must be able to capture full packet contents. Which approach should be used?

   • AConfigure a firewall to log all connections
   • BDeploy an inline IPS with logging enabled
   • CInstall a passive tap and capture to a storage array
   • DUse NetFlow export from the router
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a key difference between inline interrogation and tap-based monitoring?

   • AInline devices only monitor traffic, while taps can also block malicious traffic.
   • BInline devices are used for passive analysis, while taps are used for active enforcement.
   • CInline devices are passive and do not affect traffic flow, while taps are active and can block traffic.
   • DInline devices are placed in the data path and can affect traffic, while taps are out-of-band and only receive a copy.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team wants to monitor traffic between two data center switches for troubleshooting. The monitoring must not affect the traffic flow and must be able to capture all packets. Which method should be used?

   • AInline firewall between the switches
   • BRouter with NetFlow enabled
   • CSPAN port on one switch
   • DNetwork tap placed between the switches
   Reveal Solution Discussion Select an answer first