A payment processor must block known exploits in real time, but compliance requires that card traffic keep flowing if the inspection engine fails, and the design must leave addressing and routing on the production segment exactly as they are. Which IPS deployment design satisfies all three requirements at once?
Select an answer to reveal the explanation.
Short Explanation
With an inline fail-open setup, you block known exploits while the inspection engine is running, and traffic keeps flowing if it fails—like a gate that checks visitors but opens during a power outage. You also keep the production segment’s addressing and routing unchanged.
Full Explanation
An inline set sits directly in the traffic path, so it can drop detected exploits in real time. With fail-open configured, traffic is allowed through uninspected if the inspection engine fails, while the inline deployment can preserve the existing production-segment addressing and routing. Fail-closed drops traffic when the inspection engine fails, breaking the availability requirement. Tap-mode or passive inspection does not interrupt traffic, but it also cannot drop an exploit, so it fails the enforcement requirement. A routed-mode deployment with policy routing can block traffic, but it makes the appliance part of the routed topology and would not preserve the production-segment routing as specified. Fail-open trades protection for uptime during an inspection-engine failure, so monitor the inline set and consider a redundant path. In a lab, verify that traffic passes during an inspection-engine restart and that the configured policy blocks detected exploits when the engine is operating.