312-50 Question 262
Single answer▪ IDS, IPS, Firewall, and Honeypot SolutionsA security team is investigating repeated attempts to exploit a vulnerable web application hosted in a DMZ. Management wants a control that can automatically stop known malicious HTTP requests before they reach the server, while still allowing the team to monitor attack patterns for later analysis. Which solution best meets the requirement?
- A
Deploy a network-based IPS inline in front of the web server and forward its alerts to a SIEM
- B
Deploy a network-based IDS on a SPAN port and configure it to drop malicious packets
- C
Place a low-interaction honeypot in front of the production web server to block exploitation attempts
- D
Replace the perimeter firewall with a passive IDS because IDS provides better application-layer blocking
Show answer and explanation
Correct answer: A
Explanation
The key requirement is to stop known malicious HTTP requests before they reach the web server. That calls for an inline prevention technology, which is the role of an IPS. In contrast, an IDS is generally passive and focused on detection and alerting rather than blocking. A honeypot is useful for deception, intelligence gathering, and studying attacker behavior, but it is not a production protection mechanism for inline prevention. Firewalls enforce access rules and, depending on type, may provide some application awareness, but the scenario specifically emphasizes automatic blocking of known malicious requests and monitoring attack patterns, which aligns best with an IPS integrated with centralized logging or SIEM. This is consistent with common security architecture guidance from vendors and standards bodies such as NIST, which distinguish IDS as detection-oriented and IPS as prevention-oriented, particularly when deployed inline.
- A. Correct.
Correct. A network-based IPS is deployed inline, so it can actively inspect and block known malicious traffic before it reaches the target server. Sending IPS alerts to a SIEM supports later analysis, correlation, and incident response. This directly satisfies both requirements: prevention and monitoring.
- B. Incorrect.
Incorrect. A network-based IDS connected to a SPAN or mirror port is typically out-of-band and passive. It can detect and alert on suspicious traffic, but it does not normally sit inline to block packets. The statement that it can be configured to drop malicious packets reflects a common confusion between IDS and IPS.
- C. Incorrect.
Incorrect. A honeypot is designed to attract, observe, and study attacker behavior, not to serve as a primary inline blocking control for production traffic. A low-interaction honeypot may help collect indicators and techniques, but placing it in front of a live web server would not be an appropriate way to stop malicious requests to the actual application.
- D. Incorrect.
Incorrect. A passive IDS does not replace a firewall for traffic enforcement and does not provide active blocking simply by virtue of inspecting traffic. Firewalls enforce access-control policies, and many next-generation firewalls can inspect application traffic, but a passive IDS alone is not a substitute for an enforcement device.