Cisco CyberOps Associate (CBROPS) 200-201Network Intrusion AnalysisEasy
A network security analyst is deploying a new intrusion prevention system (IPS) in an inline configuration. Which of the following is a primary concern for the analyst regarding the IPS's impact on network traffic flow?
- AIncreased network latency
- BDecreased need for firewall rules
- CReduced CPU utilization on endpoint devices
- DSimplified network segmentation
Show answer & explanationAnswer & explanation
Correct answer: A. Increased network latency
An IPS in inline mode actively analyzes and potentially modifies or drops traffic, which inherently introduces processing delays and can lead to increased network latency.
Why the other options are wrong
- B. An IPS complements firewalls; it does not decrease the need for their rule sets, which provide initial access control.
- C. An IPS operates independently of endpoint devices and does not directly affect their CPU utilization.
- D. An IPS does not inherently simplify network segmentation; it provides protection within existing segments.
IPS Inline Deployment
An Intrusion Prevention System (IPS) deployed in inline mode sits directly in the path of network traffic, actively inspecting and enforcing security policies. It can block or modify malicious traffic in real-time.
- Traffic flows directly through the IPS
- Can block or alter malicious traffic
- Introduces a single point of failure
- Can add latency to network communications
Memory trick: IPS deployments are either 'In-Line' for active blocking or 'Passive' for alerts.