712-50 Question 294
Single answerIdentify the appropriate intrusion detection and prevention systems for organizational information securityA global financial services company is moving several customer-facing applications to a hybrid environment with workloads split between its on-premises data center and a public cloud provider. The CISO is concerned about preventing exploit attempts against internet-facing web applications, while also gaining visibility into suspicious lateral movement between internal server segments if an attacker bypasses perimeter defenses. The company has limited tolerance for disruption to legitimate traffic because the applications support real-time transactions. Which of the following is the MOST appropriate approach?
- A
Deploy a network-based IPS inline at the internet perimeter for web traffic, and add network-based IDS sensors on key internal segmentation points to monitor east-west traffic
- B
Deploy host-based IDS on all employee workstations only, because endpoint visibility is sufficient to detect both external attacks and lateral movement
- C
Deploy a signature-based antivirus solution on application servers and rely on firewall logs for intrusion detection across the environment
- D
Deploy a single network-based IDS at the perimeter only, because placing devices inline would create unacceptable operational risk
Show answer and explanation
Correct answer: A
Explanation
The best answer is to combine technologies based on traffic location, business impact, and security objective: IPS where active blocking is required, and IDS where visibility is needed with lower risk of interrupting legitimate traffic. For customer-facing applications, a network-based IPS at the perimeter or in front of protected segments is appropriate when the organization wants to stop known malicious traffic before it reaches target systems. For detecting lateral movement, internal network-based IDS sensors placed at trust boundaries or segmentation points are effective because they monitor east-west traffic patterns that perimeter tools often miss. This layered approach is consistent with defense-in-depth principles and with guidance from sources such as NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems, which distinguishes between host-based and network-based IDS/IPS roles and emphasizes selecting placement and mode of operation according to organizational objectives and risk tolerance. In practice, CISOs should also ensure IPS policies are tuned carefully, integrated with logging/SIEM workflows, and supported by segmentation architecture to reduce false positives and operational disruption.
- A. Correct.
Correct. This approach aligns the control to the risk and business requirement. A network-based IPS (NIPS) placed inline at the internet edge can actively block known exploit attempts and malicious traffic aimed at public-facing applications, which addresses the prevention requirement. Adding network-based IDS (NIDS) sensors at internal segmentation points provides visibility into east-west traffic and potential lateral movement without introducing unnecessary disruption to internal application flows. This combination balances prevention and detection while respecting the organization's low tolerance for false positives affecting real-time transactions.
- B. Incorrect.
Incorrect. Host-based IDS on employee workstations may help detect suspicious activity on those endpoints, but it does not adequately address attacks against internet-facing web applications or provide broad visibility into lateral movement between internal server segments. It also ignores the need for preventive controls at the perimeter. A candidate might choose this option because endpoint telemetry is valuable, but by itself it is insufficient for the scenario described.
- C. Incorrect.
Incorrect. Antivirus on servers is not a substitute for intrusion detection and prevention systems. Traditional antivirus is primarily designed to identify malicious files or known malware behavior on hosts, not to inspect network traffic for exploit attempts or detect lateral movement patterns across segments. Firewall logs can contribute to monitoring, but they do not provide the same depth of inspection, alerting, or blocking capability as dedicated IDS/IPS technologies. This option reflects the common misconception that basic endpoint protection plus log review is enough for network intrusion defense.
- D. Incorrect.
Incorrect. A perimeter NIDS would provide useful visibility into north-south traffic, but it would not prevent exploit attempts, which is explicitly required in the scenario. It also would not effectively monitor east-west movement inside the environment if deployed only at the perimeter. While the concern about inline operational risk is valid, modern IPS deployments are commonly used when prevention is needed, provided they are properly tuned, staged, and managed. This option underestimates the need for both prevention and internal visibility.