200-201 Question 255
Select 3A cybersecurity analyst is tasked with implementing a solution to monitor network traffic for potential threats. The analyst is considering using either an inline traffic interrogation tool or a network tap for traffic monitoring. Which of the following statements correctly compares these two approaches?
- A
Inline traffic interrogation can actively block malicious traffic, whereas a network tap only allows passive monitoring.
- B
Network taps are generally placed directly in the flow of traffic and can drop packets if overloaded.
- C
Inline traffic interrogation introduces latency to the network as traffic must pass through the device for analysis.
- D
Network taps do not alter the original traffic flow and provide a copy of the traffic for analysis.
- E
Inline traffic interrogation tools are typically used for forensic analysis after an incident has occurred.
Show answer and explanation
Correct answers: A, C, D
Explanation
Inline traffic interrogation operates directly in the traffic flow and is capable of actively blocking or modifying malicious traffic, which may introduce latency. On the other hand, network taps are passive devices that provide a mirrored copy of traffic for analysis without altering or impacting the original traffic flow. Understanding the operational differences between these tools is critical for choosing the appropriate solution based on the network's security and performance requirements.
- A. Correct.
Correct. Inline traffic interrogation operates in the path of traffic and can actively block or modify malicious traffic, unlike network taps which are passive.
- B. Incorrect.
Incorrect. Network taps are passive devices that do not sit directly in the traffic flow and do not introduce the risk of packet loss due to overload. They only mirror traffic for monitoring purposes.
- C. Correct.
Correct. Inline traffic interrogation can introduce some latency because all traffic must pass through the device for inspection, potentially slowing down communications.
- D. Correct.
Correct. Network taps are passive and simply provide a duplicate stream of traffic for analysis without disrupting the original traffic flow.
- E. Incorrect.
Incorrect. Inline traffic interrogation is designed for active prevention and real-time threat mitigation, not primarily for forensic analysis after an incident.