A security team is implementing network security monitoring and must decide where to place IDS/IPS sensors relative to NAT boundaries. What monitoring blind spot does NAT create for an IDS sensor placed outside the NAT boundary?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because NAT translates internal private IPs to a shared public IP; an IDS outside NAT sees all traffic as originating from the public IP, losing the ability to identify which specific internal host generated the traffic without correlating with firewall NAT translation logs. A is wrong because TLS visibility depends on decryption capability, not NAT placement.
Full explanation below image
Full Explanation
B is correct because NAT translates internal private IPs to a shared public IP; an IDS outside NAT sees all traffic as originating from the public IP, losing the ability to identify which specific internal host generated the traffic without correlating with firewall NAT translation logs. A is wrong because TLS visibility depends on decryption capability, not NAT placement. C is wrong because ICMP is NATted along with other traffic and is visible to the sensor; NAT does not specifically block ICMP visibility. D is wrong because NAT operates at Layer 3 and does not change Layer 4 protocol type.