4.4 Compare Inline Traffic Interrogation and Taps or Traffic Monitoring 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which statement accurately describes how an inline security device inspects traffic?

   • AIt inspects traffic by querying flow records from routers after the traffic has been forwarded.
   • BIt inspects a copy of the traffic provided by a TAP and sends the original traffic unchanged.
   • CIt inspects traffic only after the destination has received it, using logs from the endpoint.
   • DIt inspects traffic as it passes through the device, allowing the device to drop or modify packets before they reach the destination.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team wants to automatically quarantine infected endpoints by sending blocking commands to the network when a threat is detected. Which monitoring approach is best suited for this requirement?

   • ANetFlow collector that detects anomalies and logs them
   • BSPAN port sending traffic to a forensic analyzer
   • CInline IPS that can drop traffic and integrate with network access control (NAC)
   • DPassive tap feeding an IDS that sends alerts to a SIEM
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company needs to inspect encrypted traffic (TLS) to detect malware command-and-control activity. The security team wants to decrypt, inspect, and re-encrypt traffic in real time. Which deployment is required?

   • ASPAN port sending traffic to a forensic tool
   • BPassive tap with a TLS-decryption appliance
   • CInline security appliance with TLS interception capabilities
   • DNetFlow collector that analyzes flow metadata
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the defining characteristic of inline traffic interrogation?

   • AThe device is physically positioned in the data path so that all traffic must pass through it before reaching its destination.
   • BThe device uses a network tap to duplicate traffic and sends the copy to an analysis tool for offline inspection.
   • CThe device receives a copy of the traffic from a switch port and analyzes it without affecting the original flow.
   • DThe device is connected to a switch SPAN port and receives a copy of traffic for real-time analysis.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security engineer is troubleshooting a network issue where an inline IPS is dropping legitimate traffic. The IPS is in fail-closed mode. The engineer needs to maintain security enforcement while minimizing impact on legitimate traffic. Which action should the engineer take first?

   • ASwitch the IPS to fail-open mode
   • BIncrease the IPS inspection depth
   • CReplace the inline IPS with a passive tap
   • DReview the IPS logs and rules to identify false positives
   Reveal Solution Discussion Select an answer first