Network and Communications Security →hardMultiple SelectObjective-mapped

SSCP Network and Communications Security Practice Question

An organization is deploying a network-based intrusion detection system (NIDS). The security team must decide on placement and configuration. Which THREE considerations are critical for effective NIDS deployment?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Using a network tap or SPAN port to monitor traffic without introducing latency

Using a network tap or SPAN port ensures full visibility without introducing latency (A). Placing the NIDS on the internal network behind the firewall allows it to detect insider threats that have already passed perimeter defenses (D). Tuning signatures to match the environment reduces false positives, making alerts more actionable (E).

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Using a network tap or SPAN port to monitor traffic without introducing latency
Why this is correct
Passive monitoring avoids impact on network performance.
✗
Placing the NIDS inline to block malicious traffic immediately
Why it's wrong here
That describes an IPS, not an IDS.
✗
Configuring the NIDS to drop packets that match attack signatures
Why it's wrong here
Dropping packets is an IPS function; IDS only alerts.
✓
Placing the NIDS on the internal network behind the firewall to detect insider threats
Why this is correct
Monitoring internal traffic helps detect attacks from compromised hosts.
✓
Tuning signatures to reduce false positives relevant to the environment
Why this is correct
Proper tuning improves detection accuracy and reduces alert fatigue.

Go deeper

SSCP Network and Communications Security Practice Question

Why each option matters

Option-by-option breakdown

Related to this question