200-201 Question 230
Single answerA Security Operations Center (SOC) analyst is tasked with configuring an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS) to protect the organization's network. During testing, they notice that the IDS is alerting on suspicious traffic, but the IPS is not blocking it. What is the most likely cause of this behavior?
- A
The IDS and IPS are using different signature databases.
- B
The IPS is configured in monitoring mode instead of inline mode.
- C
The IDS and IPS are deployed on separate network segments.
- D
The IDS has a higher priority than the IPS in the network configuration.
Show answer and explanation
Correct answer: B
Explanation
The IPS needs to be deployed in inline mode to actively block malicious traffic. In monitoring mode, the IPS functions similarly to an IDS, only observing and reporting on traffic without taking any action. Ensuring the correct deployment mode is essential for proper IPS functionality.
- A. Incorrect.
While it’s possible for the IDS and IPS to use different signature databases, this would not directly cause the IPS to fail to block traffic. The IPS would still act based on its own database.
- B. Correct.
If the IPS is configured in monitoring mode (also known as passive mode), it will not actively block traffic. Inline mode is required for an IPS to function as intended and block malicious traffic.
- C. Incorrect.
Deploying the IDS and IPS on separate network segments could affect traffic analysis, but this scenario specifically describes the IPS not blocking traffic, which is unrelated to network segmentation.
- D. Incorrect.
An IDS does not have priority over an IPS in terms of traffic control. The two systems operate independently, and priority settings would not cause an IPS to fail to block traffic.