312-50 Question 260
Single answer▪ IDS, IPS, Firewall, and Honeypot ConceptsA company hosts a public web application in a DMZ and has recently experienced repeated SQL injection and directory traversal attempts from the Internet. The security team wants a control that can inspect inbound HTTP/HTTPS traffic inline and automatically block malicious requests before they reach the web server. They do not want a solution that only generates alerts after the traffic has already passed. Which technology best meets this requirement?
- A
Network-based IDS deployed on a SPAN port
- B
Network-based IPS deployed inline in front of the web server
- C
Honeypot placed in the DMZ to attract attackers
- D
Stateless packet-filtering firewall configured to allow TCP ports 80 and 443
Show answer and explanation
Correct answer: B
Explanation
The key requirement is preventive, inline inspection of web traffic. That points to an IPS rather than an IDS. In CEH contexts, IDS is commonly described as a detection mechanism that monitors and alerts, while IPS is positioned inline to detect and prevent malicious traffic in real time. A basic firewall can restrict access by IP, port, and protocol, but unless it includes advanced application inspection features, it is not sufficient to stop payload-based web attacks such as SQL injection. A honeypot serves a different purpose: deception and observation rather than primary inline protection. This aligns with common security architecture guidance, including the distinction between detection and prevention controls described in vendor and standards documentation such as NIST security monitoring guidance and mainstream IDS/IPS deployment best practices.
- A. Incorrect.
A network-based IDS on a SPAN or mirror port is primarily a passive detection technology. It analyzes copied traffic and can generate alerts on suspicious activity, but it does not sit inline to actively block malicious HTTP requests before they reach the target. This is a common misconception because IDS and IPS often use similar detection signatures, but their enforcement capabilities differ.
- B. Correct.
A network-based IPS deployed inline is the best fit because it can inspect live traffic in real time and take preventive action, such as dropping packets, resetting connections, or blocking malicious request patterns associated with attacks like SQL injection and directory traversal. Since the requirement specifically calls for automatic blocking before traffic reaches the web server, inline IPS functionality matches the need.
- C. Incorrect.
A honeypot can be useful for deception, threat intelligence, and identifying attacker behavior, but it is not designed to protect a production web server by inspecting and blocking all inbound malicious traffic. A honeypot may attract some attackers away from legitimate assets, but it does not provide the inline prevention required in this scenario.
- D. Incorrect.
A stateless packet-filtering firewall can allow or deny traffic based on basic header information such as source, destination, port, and protocol. However, it does not inspect web application payloads deeply enough to reliably detect and block SQL injection or directory traversal attempts within allowed HTTP/HTTPS sessions. Allowing ports 80 and 443 would still permit the malicious application-layer traffic.