A security engineer wants to deploy IDS sensors to detect lateral movement within the enterprise. Where should sensors be placed for maximum effectiveness?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because lateral movement occurs on internal east-west traffic; sensors between workstation and server segments capture attacker pivoting between systems. A is wrong because perimeter-only sensors miss lateral movement entirely after initial compromise.
Full explanation below image
Full Explanation
C is correct because lateral movement occurs on internal east-west traffic; sensors between workstation and server segments capture attacker pivoting between systems. A is wrong because perimeter-only sensors miss lateral movement entirely after initial compromise. B is wrong because WAN links between data centers capture replication traffic but not internal workstation-to-server movement. D is wrong because monitoring only the management VLAN ignores the primary attack surface for lateral movement.