A network team is adding an intrusion prevention system to the internet edge. They want it to block attacks in real time but inspect only traffic that the edge firewall has already permitted, so it is not overloaded by traffic the firewall would drop anyway. Where should the IPS be placed?
Select an answer to reveal the explanation.
Short Explanation
Think of the firewall as the gate guard and the IPS as the inspector just inside. Put the IPS inline, behind the firewall, and you've given it only the folks the guard already let in to examine, and it can still stop trouble on the spot. A mirrored port can only watch and yell; it can't block.
Full Explanation
An intrusion prevention system must be placed inline, in the actual traffic path, to block malicious traffic in real time; a device that only receives copies of traffic can detect and alert but cannot stop packets that have already passed. Placing it on the internal side of the edge firewall means it receives only traffic the firewall's rules have permitted, so its inspection capacity is spent on traffic that could actually reach internal systems rather than on the large volume of unsolicited traffic the firewall drops. Inline placement on the internet side would let the IPS block attacks, but it would inspect all inbound traffic before the firewall filters it, which contradicts the requirement to avoid wasting capacity on traffic that will be dropped anyway. A mirrored port on the internal side sees the permitted traffic, but a passive copy makes the device function as a detection system that cannot block in real time. A mirrored port on the internet side combines both problems: it sees unfiltered traffic and cannot block anything. Exam caveat: inline devices add a potential point of failure, so their failure mode and redundancy should be planned. Operational check: confirm the IPS is in the forwarding path behind the firewall, verify blocking with a controlled test signature, and review how it behaves if it fails.