642-825 Implementing Secure Converged Wide Area Networks Testking Exam

Demo Question 6.

Answer: A, E

Explanation: The IDS is a software- or hardware-based solution that passively listens to network traffic. The IDS is not in the traffic path, but listens promiscuously to all traffic on the network. Typically, only one promiscuous interface is required for network monitoring. Additional promiscuous interfaces can be used to monitor multiple networks. When the IDS detects malicious traffic, it sends an alert to the management station. The IDS has limited active response capabilities. When configured, the IDS can block further malicious traffic by actively configuring network devices (for example, security appliances or routers) in response to malicious traffic detection. However, the original malicious traffic has already passed through the network to its destination and cannot be blocked. Only subsequent traffic will be blocked. The IDS also has the capability of sending a TCP reset to the end host to terminate any malicious TCP connections.