1.5 Cisco NGIPS Deployment Modes CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A non-profit organization has a limited budget and wants to use an existing Cisco NGIPS to monitor traffic on their internet link. They have a switch that supports SPAN, but the switch is already heavily loaded. They cannot afford a TAP. What is the best option?

   • AUse SPAN and monitor switch CPU usage
   • BDeploy the NGIPS in-line with fail-open
   • CUse a TAP despite the cost
   • DUse passive SPAN on a different switch
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial trading firm has a low-latency network and wants to monitor for anomalies without adding any delay to transactions. They have a Cisco NGIPS and are considering a TAP or SPAN. The switch supports SPAN, but the network team is worried about SPAN dropping packets during bursts. What should they do?

   • ADeploy in-line with fail-open
   • BUse a network TAP
   • CUse SPAN
   • DUse SPAN with increased buffer
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A large enterprise has a Cisco NGIPS that must protect a critical data center link. The security policy requires blocking of all known malicious traffic, but the business cannot tolerate any downtime. The network team has two options: in-line with fail-open or in-line with fail-closed. They also need to ensure that if the NGIPS fails, traffic is still monitored by a secondary device. What is the best solution?

   • ADeploy in-line with fail-open and rely on the NGIPS logs
   • BDeploy in-line with fail-closed and rely on the NGIPS logs
   • CDeploy in-line with fail-open and add a passive TAP feeding a secondary monitoring device
   • DDeploy passively with SPAN and use out-of-band resets
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A service provider is deploying a Cisco NGIPS to monitor a 40 Gbps backbone link. The switch supports SPAN, but the provider has experienced SPAN drops on other links. They have a budget for a TAP, but the TAP only supports 10 Gbps per port. The link is a single 40 Gbps link. What is the best approach?

   • ADeploy in-line with fail-open
   • BUse a 10 Gbps TAP and only monitor a portion
   • CUse a TAP with 4x10 Gbps output and aggregate them into the NGIPS
   • DUse SPAN and accept potential drops
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has a Cisco NGIPS deployed in passive mode using SPAN. They are seeing false negatives because the SPAN port is dropping packets during peak hours. They have a budget to upgrade, but they cannot replace the switch. What is the best solution to improve monitoring accuracy?

   • AInstall a network TAP on the critical links
   • BSwitch to in-line deployment
   • CIncrease the SPAN buffer on the switch
   • DUse SPAN on a different switch
   Reveal Solution Discussion Select an answer first