1.5 Cisco NGIPS Deployment Modes CCIE-SECURITY Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How does TAP-based monitoring differ from SPAN-based monitoring for a Cisco NGIPS?

   • ATAP-based monitoring requires the NGIPS to be the default gateway.
   • BTAP-based monitoring uses a dedicated hardware device to copy traffic, while SPAN-based monitoring uses switch port mirroring.
   • CTAP-based monitoring is in-line, while SPAN-based monitoring is passive.
   • DTAP-based monitoring can block traffic, while SPAN-based monitoring cannot.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial services firm must block a newly discovered exploit that uses a specific TCP port. The security team wants the NGIPS to drop malicious packets immediately while allowing all other traffic. The network currently has a SPAN port available on the core switch. What should the team do to meet the blocking requirement?

   • ADeploy the NGIPS in inline mode between the core switch and the firewall, and enable blocking actions.
   • BDeploy the NGIPS in passive mode using the SPAN port and configure an alert.
   • CUse a TAP to send traffic copies to the NGIPS and enable blocking.
   • DConfigure the SPAN port to send traffic to the NGIPS and set the action to 'drop'.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A university wants to monitor traffic on a high-utilization backbone link for threat detection without risking any impact on network performance. They have a network TAP available. What is the most appropriate deployment for the NGIPS?

   • AInline deployment with fail-open mode
   • BPassive deployment using the TAP
   • CInline deployment between two routers
   • DPassive deployment using a SPAN port
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A retail company needs to monitor traffic between two switches for intrusion detection. They are concerned about SPAN port oversubscription dropping packets during peak hours. What should they use to ensure the NGIPS receives a reliable copy of all traffic?

   • ADeploy the NGIPS inline between the switches
   • BUse a passive SPAN port with increased buffer
   • CInsert a network TAP between the switches and connect the NGIPS to the TAP
   • DConfigure a SPAN session on the switch and send to the NGIPS
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A hospital network must prevent ransomware from spreading between departments. The security team wants the NGIPS to automatically block malicious traffic while maintaining high availability. Which deployment mode should they choose?

   • AInline deployment with fail-closed mode
   • BTAP deployment with blocking
   • CPassive deployment with alerting
   • DInline deployment with fail-open mode
   Reveal Solution Discussion Select an answer first