N10-009 Network Security Practice Question
A security team is deploying a new intrusion detection system (IDS) and wants to analyze all traffic entering and exiting the network without introducing latency or a single point of failure. How should the IDS be connected to the network?
⚠ Common exam trap
The N10-009 exam often tests the distinction between inline (active) and passive (out-of-band) deployments, and the trap here is that candidates mistakenly choose inline placement because they think the IDS must 'see' all traffic by being in the path, ignoring the latency and single-point-of-failure consequences.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Connected to a network tap or spanned port on the core switch
Connecting the IDS to a network tap or a spanned port (SPAN/mirror port) on the core switch allows it to receive a copy of all traffic entering and exiting the network without being in the data path. This passive deployment introduces zero latency because the IDS never forwards or blocks traffic, and it eliminates a single point of failure since the network continues to operate if the IDS fails or is taken offline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Inline between the firewall and the core switch
Why it's wrong here
Placing an Intrusion Detection System (IDS) inline between the firewall and core switch would force all network traffic to pass directly through the IDS device. This configuration introduces significant latency, as the IDS must process every packet before forwarding it, and creates a single point of failure. If the IDS device experiences a malfunction or requires maintenance, it would disrupt all network connectivity, which is unacceptable for a system primarily designed for detection rather than prevention.
When this WOULD be correct
When deploying an intrusion prevention system (IPS) that must actively block malicious traffic, inline connection between firewall and core switch is required.
- ✓
Connected to a network tap or spanned port on the core switch
Why this is correct
An Intrusion Detection System (IDS) is designed to passively monitor network traffic for suspicious activity without interfering with the data flow. Connecting it to a network tap or configuring a Switched Port Analyzer (SPAN) port on the core switch provides a non-intrusive, out-of-band copy of all traffic traversing critical network segments. This passive monitoring ensures the IDS does not introduce latency or become a single point of failure, which is crucial for maintaining network performance and availability while providing comprehensive visibility into potential threats.
- ✗
Directly connected to the internet router
Why it's wrong here
Connecting an IDS directly to the internet router would limit its visibility to only the traffic entering and exiting the network via that specific device. This placement would completely miss internal network traffic, traffic between different internal segments, or traffic traversing other network devices, significantly hindering its ability to detect internal threats or lateral movement. Furthermore, depending on the router's capabilities, this connection might still be inline, introducing the same performance and reliability issues as other inline deployments.
When this WOULD be correct
If the question asked for a method to monitor all internet-bound traffic with minimal cost and without requiring switch configuration, connecting the IDS directly to the internet router could be correct, assuming the router supports port mirroring and the IDS is passive.
- ✗
Connected to the management network
Why it's wrong here
The management network is typically a segregated segment dedicated to administrative access and control plane traffic for network devices, servers, and other infrastructure components. An IDS connected solely to this network would only observe administrative communications, such as SSH, Telnet, SNMP, or device configuration changes. It would completely miss the vast majority of user data traffic, application traffic, and other operational data that an IDS needs to analyze for detecting actual intrusions or malicious activity affecting end-users and services.
When this WOULD be correct
A question asking how to securely manage an IDS appliance, with constraints like 'the IDS must be accessible only to administrators and isolated from production traffic' would make connecting it to the management network correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Connected to a network tap or spanned port on the core switchCorrect answer▾
Why this is correct
An Intrusion Detection System (IDS) is designed to passively monitor network traffic for suspicious activity without interfering with the data flow. Connecting it to a network tap or configuring a Switched Port Analyzer (SPAN) port on the core switch provides a non-intrusive, out-of-band copy of all traffic traversing critical network segments. This passive monitoring ensures the IDS does not introduce latency or become a single point of failure, which is crucial for maintaining network performance and availability while providing comprehensive visibility into potential threats.
✗Inline between the firewall and the core switchWrong answer — click to see why▾
Why this is wrong here
Inline placement introduces latency and creates a single point of failure, contradicting the requirement to avoid both.
★ When this WOULD be the correct answer
When deploying an intrusion prevention system (IPS) that must actively block malicious traffic, inline connection between firewall and core switch is required.
Why candidates choose this
Candidates may assume IDS must be inline to see all traffic, confusing IDS with IPS or firewall functionality.
✗Directly connected to the internet routerWrong answer — click to see why▾
Why this is wrong here
Connecting the IDS directly to the internet router would place it inline with all internet traffic, but this creates a single point of failure and introduces latency, contradicting the requirement to avoid both.
★ When this WOULD be the correct answer
If the question asked for a method to monitor all internet-bound traffic with minimal cost and without requiring switch configuration, connecting the IDS directly to the internet router could be correct, assuming the router supports port mirroring and the IDS is passive.
Why candidates choose this
Candidates may think the internet router is the single chokepoint for all external traffic, so connecting there seems like a simple way to see all traffic, overlooking the failure and latency issues.
✗Connected to the management networkWrong answer — click to see why▾
Why this is wrong here
Connecting the IDS to the management network would only allow it to see management traffic, not all network traffic entering and exiting the network, failing to meet the requirement to analyze all traffic.
★ When this WOULD be the correct answer
A question asking how to securely manage an IDS appliance, with constraints like 'the IDS must be accessible only to administrators and isolated from production traffic' would make connecting it to the management network correct.
Why candidates choose this
Candidates may think the management network is a secure place to connect security devices, overlooking that the IDS needs visibility into production traffic, not just management traffic.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
Switched Port Analyzer
A Switched Port Analyzer (SPAN) is a feature on network switches that copies traffic from one or more ports to a monitoring port for analysis.
Key term
SPAN
A Switch Port Analyzer (SPAN) is a feature on network switches that copies traffic from one or more ports to a monitoring port for analysis without disrupting normal network operations.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.