SY0-701 Question 203
Single answerDevice attribute: Active vs. passive , Inline vs. tap/monitorA security administrator must deploy a new monitoring solution on a critical link between the core switch and the internet edge. Management requires that the device must be able to automatically block malicious traffic in real time, but the network team is concerned that placing anything directly in the traffic path could create a single point of failure. Which deployment best meets the requirement to stop attacks immediately while highlighting the primary tradeoff?
- A
Deploy an active device inline; it can inspect and block traffic, but it may affect availability if the device fails or becomes overloaded.
- B
Deploy a passive device on a network tap; it can block malicious traffic without being in the traffic path and avoids any availability risk.
- C
Deploy a passive device using port mirroring; it can drop malicious packets before they reach the firewall while remaining out of band.
- D
Deploy an active device on a network tap; it can terminate suspicious sessions and still remain completely isolated from production traffic.
Show answer and explanation
Correct answer: A
Explanation
The key distinction is between active vs. passive and inline vs. tap/monitor deployments. Active devices can affect traffic flow by blocking, dropping, resetting, or otherwise preventing malicious activity. To do that directly, they typically must be deployed inline, meaning traffic passes through them. Passive devices, such as IDS sensors connected via a network tap or SPAN/port mirror, analyze copied traffic and provide visibility and alerting but do not directly stop packets on that link.
In practice, an inline IPS best satisfies a requirement to block malicious traffic in real time. However, best-practice design considerations include high availability, bypass/fail-open or fail-closed behavior, capacity planning, and careful change control because inline devices can introduce performance and availability risks. This aligns with common vendor and industry guidance for IDS/IPS architecture: IDS is typically passive and out of band; IPS is typically active and inline.
- A. Correct.
Correct. An active security device, such as an inline IPS, sits directly in the traffic path and can take preventive action like dropping packets, resetting connections, or blocking traffic in real time. The tradeoff is that inline placement introduces potential latency and can create an availability concern if the device fails, is misconfigured, or is undersized. This directly matches the scenario's need for immediate blocking while acknowledging the network team's concern.
- B. Incorrect.
Incorrect. A passive device connected through a tap receives a copy of traffic for analysis but is not in the path of traffic flow. Because it is out of band, it generally cannot directly block packets traversing the link. This option reflects a common misconception that visibility alone enables prevention.
- C. Incorrect.
Incorrect. Port mirroring, like a network tap, is typically used for passive monitoring by sending copies of packets to a sensor. A passive device connected this way can detect and alert on malicious activity, but it cannot directly drop packets before they traverse the link. Someone might choose this option because SPAN/port mirroring is often associated with IDS deployments, but IDS monitoring is detective rather than preventive unless integrated with other enforcement controls.
- D. Incorrect.
Incorrect. A network tap is used to feed copied traffic to monitoring tools and supports passive visibility. An active device must be inline to directly enforce blocking on the traffic stream. While some platforms can send commands to other devices for response, that is not the same as directly terminating sessions from a passive tap position on the monitored link.