312-50 Question 261
Single answer▪ IDS, IPS, Firewall, and Honeypot SolutionsA company hosts a public-facing customer portal in a DMZ. During a red-team exercise, the security team observes repeated SQL injection attempts and several malformed HTTP requests targeting the web application. Management wants a control that can automatically stop these malicious requests in real time without waiting for an analyst to intervene, while still allowing the security team to monitor attack patterns for future tuning. Which solution best meets this requirement?
- A
Deploy a network-based IDS in the DMZ to alert on suspicious HTTP payloads
- B
Deploy a network-based IPS inline between the Internet edge and the web server segment
- C
Deploy a low-interaction honeypot in the DMZ to attract and log attacker activity
- D
Deploy a stateful firewall and allow only TCP port 443 to the web server
Show answer and explanation
Correct answer: B
Explanation
The key requirement is prevention in real time. In CEH-relevant security architecture, IDS is primarily detective, IPS is preventive, firewalls enforce network access policy, and honeypots support deception and intelligence gathering. Because the attacks involve application-layer HTTP payloads and management wants automatic blocking, an inline IPS is the best fit among the listed choices. In practice, organizations often combine controls: a firewall limits exposed services, an IPS blocks known malicious traffic inline, an IDS or SIEM provides additional monitoring, and a honeypot can collect threat intelligence. Best-practice guidance from vendors and common network security architecture references consistently distinguishes IDS as alerting and IPS as active blocking when deployed inline.
- A. Incorrect.
Incorrect. A network-based IDS can detect and alert on suspicious traffic, including signatures associated with SQL injection or malformed requests, but it is typically out-of-band and does not block traffic automatically. This option partially addresses visibility but not the requirement to stop malicious requests in real time.
- B. Correct.
Correct. A network-based IPS is deployed inline and can inspect traffic as it passes through the device, allowing it to drop, reset, or otherwise block malicious requests in real time. This directly satisfies the requirement for automatic prevention while still generating logs and alerts that analysts can use to monitor attack patterns and tune signatures or policies.
- C. Incorrect.
Incorrect. A low-interaction honeypot is useful for deception, early warning, and studying attacker behavior, but it does not protect the production web application from active attacks. Attackers may interact with the honeypot instead of real systems in some cases, but it is not the best control for blocking malicious requests to the actual portal.
- D. Incorrect.
Incorrect. A stateful firewall is effective for controlling connections based on IP addresses, ports, protocols, and connection state, but simply allowing HTTPS does not provide deep inspection of application-layer payloads such as SQL injection attempts. Without specialized application-layer inspection, it will not reliably identify and stop these web attacks.