A municipal data center needs visibility into east-west traffic between application tiers so an IDS can detect lateral movement. Where should sensors be placed to support that goal?
Select an answer to reveal the explanation.
Short Explanation
East-west is the sideways chatter between servers—lateral movers love that hallway. Sensors have to sit on those internal paths or the IDS is staring at the front door while the thief walks room to room. Edge-only watching misses the inside game.
Full Explanation
East-west traffic is the lateral movement between application tiers inside the municipal data center or campus fabric—web talking to app, app talking to database, microservice to microservice. An intrusion detection sensor only sees what its span, TAP, or inline path presents. Placing sensors on those internal paths is how the IDS gains visibility into sideways attacks that never cross the Internet edge.
Monitoring only the perimeter leaves server-to-server compromise invisible after the first foothold; many real incidents live almost entirely east-west after phishing or a weak remote service. Disabling sensors and relying on quarterly paper rack audits documents topology, not live malicious flows. Mirroring only printer VLAN broadcasts samples a low-value broadcast domain and does not represent application-tier threats.
Exam caveat: north-south (client-to-server or Internet edge) and east-west (lateral) are complementary coverage domains. Strong edge IDS does not automatically cover internal segments, and microsegmentation without visibility still leaves detection gaps.
Operational check: inventory trust boundaries between tiers, place IDS/NDR sensors or packet brokers on the east-west links that matter, tune for lateral techniques (credential reuse, unexpected SMB/RDP, odd database clients), and periodically validate that mirrored spans still carry the intended VLANs after network changes.