4.4 Compare Inline Traffic Interrogation and Taps or Traffic Monitoring 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which use case is a typical reason to deploy an inline security device?

   • ATo provide a copy of traffic to a separate analysis tool without affecting the original flow.
   • BTo passively record all network traffic for compliance auditing.
   • CTo perform deep packet inspection and immediately block traffic that matches a threat signature.
   • DTo collect flow records from routers for historical analysis.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   When is tap-based traffic monitoring preferred over inline interrogation?

   • AWhen the monitoring must not introduce latency or become a single point of failure.
   • BWhen the organization needs to block malicious traffic in real time.
   • CWhen the organization wants to enforce access control policies on the traffic.
   • DWhen the device needs to modify packets before forwarding them.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company must enforce a policy that blocks all traffic to a known command-and-control server. The policy must be applied immediately and must not rely on post-hoc analysis. Which solution best meets this requirement?

   • ASPAN port to a network analyzer
   • BNetwork tap feeding an IDS
   • CInline next-generation firewall with a block rule
   • DFlow collector with an alerting rule
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security appliance must be able to drop malicious packets and also provide full visibility into all traffic. The network team is concerned about a single point of failure. Which deployment should be recommended?

   • AInline appliance without bypass
   • BSPAN port only
   • CPassive tap only
   • DInline appliance with a bypass switch
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company wants to enforce a policy that blocks all peer-to-peer file sharing traffic on its network. The security team needs a solution that can actively terminate these connections. Which deployment should they choose?

   • ANetFlow collector that logs traffic patterns
   • BPassive tap with an IDS that sends alerts
   • CSPAN port feeding a network analyzer
   • DInline firewall with application-level inspection
   Reveal Solution Discussion Select an answer first