Objective 3.2: Given a scenario, apply security principles to secure enterprise infrastructure
Security+ SY0-701 practice question
A hospital places an inline IPS between its clinical network and the patient-monitoring systems. The clinical director says monitoring data must keep flowing even if the IPS hardware fails. The security team still wants the IPS to block attacks whenever it is working normally. Which configuration BEST meets both requirements?
- Configure the IPS to fail open(Correct)
Correct. Fail-open keeps patient-monitoring traffic flowing if the IPS fails, while the IPS still inspects and blocks malicious traffic whenever it is operating normally.
- Configure the IPS to fail closed
Fail-closed blocks all traffic when the device fails. That favors security, but it would cut off patient-monitoring data, which the clinical director has said must never happen.
- Replace the IPS with a passive IDS connected to a network tap
A passive IDS on a tap only receives a copy of the traffic. It would never interrupt monitoring data, but it also cannot block attacks, so it fails the security team's requirement.
- Add a second IPS inline, in series with the first one
Two inline devices in series add a second point of failure, and a failure of either one could interrupt traffic. Adding hardware does not by itself define what happens on failure, which is the actual requirement.
Explanation
The failure mode decides what an inline device does when it stops working. Fail-open lets traffic pass uninspected, which favors availability. Fail-closed blocks all traffic, which favors security (confidentiality and integrity) but causes an outage. Choose the mode based on what matters most to the business; for life-critical monitoring, availability wins. An inline device configured this way still blocks attacks during normal operation.