1

Which of the following is a reasonable response from the ids when its detects ip packets where ip source address and port is the same as the destination IP address and port

A. Allow the packet to be processed by the network and record the event B. Record selected information about the pockets and drop the pocket

Improve this question

1 Answer 1

Reset to default
1

In IDS in the classical sense is passive (D for detection) and can not drop a packet. In IPS instead (P for prevention) can drop the packet and better should do it. But the usage of the words IDS, IPS, firewall etc is too vague today that it is not clear which kind of technique you are talking about.

Improve this answer
3
  • This is one of the CISSP question, The way i see it is the option A. But book says its Option B as the right answer. Therefore is there a way for IDS to drop the packets? I mean any configuration etc
    – PCIrs
    Commented Nov 5, 2015 at 10:07
  • @PCIrs: I think my answer is quite clear that an IDS in the classical sense can not drop packets (passive only) but that the meaning of the words is so vague today that they could mean with IDS also IPS or firewall which both can drop packets. That's the difference between detection only and prevention.
    – Steffen Ullrich
    Commented Nov 5, 2015 at 10:17
  • Thanks for your comments, it may make sense if they mention IDS with a FW or not like fortigate etc
    – PCIrs
    Commented Nov 5, 2015 at 10:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .