712-50 Question 295
Single answerIdentify the appropriate intrusion detection and prevention systems for organizational information securityA global manufacturing company is moving several critical applications from a traditional data center to a hybrid environment that includes an on-premises plant network, corporate offices, and workloads in a public cloud. The CISO has been asked to improve detection and prevention of malicious activity without disrupting latency-sensitive industrial operations. The security team has limited staff, encrypted north-south traffic is increasing, and leadership wants better visibility into lateral movement between servers and user segments. Which approach is the MOST appropriate?
- A
Deploy a network-based IDS at the internet perimeter only, because most attacks originate externally and perimeter monitoring avoids impact on industrial systems
- B
Deploy host-based intrusion detection/prevention on critical servers and workloads, combined with strategically placed network-based monitoring at key internal segmentation points
- C
Rely primarily on a web application firewall for all hybrid workloads, because it can detect both host compromise and internal lateral movement across the enterprise
- D
Use signature-only network intrusion prevention inline across the plant network and all cloud connections, because blocking known attacks is preferable to adding host agents
Show answer and explanation
Correct answer: B
Explanation
The best answer is the layered approach in Option 2. In a hybrid environment, a CISO should select intrusion detection and prevention capabilities based on architecture, traffic patterns, operational sensitivity, and staffing constraints rather than relying on a single control type. Network-based IDS/IPS remains useful for monitoring traffic at perimeter and internal segmentation points, but its effectiveness is reduced when traffic is encrypted and when threats move laterally inside the environment. Host-based IDS/IPS or endpoint detection capabilities on critical servers and cloud workloads provide visibility into execution, persistence, file changes, and privilege misuse that network tools may not see. For industrial or operational technology environments, broad inline blocking can create availability risks, so passive monitoring and carefully placed controls are generally preferred unless thoroughly validated. This reflects common best practices from NIST guidance such as NIST SP 800-94 on intrusion detection and prevention systems and NIST SP 800-82 on industrial control systems security, both of which emphasize selecting controls appropriate to the environment, using defense-in-depth, and minimizing operational disruption.
- A. Incorrect.
Incorrect. A perimeter-only network IDS provides limited visibility in modern hybrid environments, especially where lateral movement, east-west traffic, and insider or compromised internal activity are key risks. It also becomes less effective as encrypted traffic increases, since payload inspection is reduced unless decryption is implemented. While perimeter monitoring is still useful, it is not sufficient by itself for the scenario described.
- B. Correct.
Correct. A combination of host-based intrusion detection/prevention on critical servers and workloads plus network-based monitoring at internal choke points aligns well with the organization's risks and constraints. Host-based controls can detect suspicious process activity, file integrity changes, privilege escalation, and malicious behavior that network tools may miss, especially in encrypted environments. Network-based monitoring at segmentation points improves visibility into lateral movement without forcing disruptive inline controls across latency-sensitive industrial operations. This layered approach is consistent with defense-in-depth and is practical for hybrid architectures.
- C. Incorrect.
Incorrect. A web application firewall is designed primarily to protect web applications and HTTP/HTTPS traffic from attacks such as injection, cross-site scripting, and protocol abuse. It is not a substitute for enterprise intrusion detection/prevention across servers, endpoints, plant systems, and non-web traffic. Choosing this option reflects a common misconception that application-layer controls can replace broader host and network intrusion capabilities.
- D. Incorrect.
Incorrect. Signature-only inline IPS everywhere is not the most appropriate choice in this scenario. First, signature-only detection misses novel or behavior-based threats. Second, deploying inline prevention broadly across latency-sensitive industrial networks can introduce operational risk and potential disruption. Third, avoiding host-based visibility is problematic when much of the traffic is encrypted and when cloud workloads require local telemetry. Inline IPS may be appropriate in selected areas, but not as the primary enterprise-wide strategy here.