4.4 Compare Inline Traffic Interrogation and Taps or Traffic Monitoring 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company needs to automatically quarantine infected hosts by blocking their traffic at the network layer. The security team wants the solution to act immediately upon detection. Which deployment is best?

   • AFlow collector with anomaly detection
   • BSPAN port with a network analyzer
   • CInline IPS with dynamic block rules
   • DPassive tap with an IDS that sends alerts to a SIEM
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company needs to block malicious traffic in real time at the network perimeter. The security team wants to inspect all traffic entering and leaving the DMZ and automatically drop packets that match known-bad signatures. Which deployment should the team choose?

   • ADeploy an inline intrusion prevention system (IPS) between the firewall and the DMZ switch.
   • BConfigure SPAN on the DMZ switch to mirror traffic to a security appliance.
   • CPlace a passive network probe on the DMZ segment and alert on suspicious activity.
   • DConnect a network tap to the link between the firewall and the DMZ switch and send a copy of traffic to an IDS.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A university wants to monitor student network usage for research purposes without affecting the performance of online exams. The monitoring must not introduce any delay or risk of disruption. Which solution should the university implement?

   • AInstall a packet capture agent on each student's computer
   • BUse a network tap to send a copy of traffic to a passive monitoring system
   • CConfigure the firewall to block all non-essential traffic and log it
   • DDeploy an inline web proxy that logs all HTTP requests
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security engineer needs to block traffic from a specific malicious IP address at the network perimeter. The solution must inspect every packet and drop matches in real time. Which approach should the engineer choose?

   • AConfigure a SPAN port on the perimeter switch to send traffic to an analysis appliance
   • BUse NetFlow export from the perimeter router to a flow collector
   • CPlace an inline intrusion prevention system (IPS) in the perimeter path
   • DDeploy a network tap on the perimeter link and connect it to an IDS
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst needs to perform a forensic analysis of network traffic on a critical production link. The link cannot experience any added latency or risk of failure. Which approach should the analyst use?

   • AConfigure the router to forward all traffic to the analyst's workstation.
   • BDeploy a passive network tap on the link and capture traffic to a monitoring device.
   • CUse a firewall's logging feature to record all traffic flows.
   • DInsert an inline security appliance into the link.
   Reveal Solution Discussion Select an answer first