Exam CISA topic 1 question 751 discussion

The BEST recommendation is to place an intrusion detection system (IDS) between the firewall and C. the Internet. Here's the reasoning: Placing the IDS before the firewall would allow it to detect attacks before they reach the firewall, potentially preventing them from causing damage. Placing the IDS after the firewall would only detect attacks that managed to bypass the firewall, which is less effective. Therefore, placing the IDS between the firewall and the Internet provides the best protection against a wide range of attacks.

If u place the IDS as a first line of defense, it will overloaded with traffic. Use the firewall to filter incomming traffic then use the IDS to identify intrusions. The answer is D.

Placing the IDS between the firewall and the Internet (option C) may be effective in monitoring incoming traffic from external sources, but it wouldn't provide visibility into traffic passing through the firewall and potentially targeting the DMZ. Similarly, placing the IDS between the firewall and the organization's network (option D) would focus on internal traffic but wouldn't specifically address threats targeting the DMZ. Therefore, placing the IDS between the firewall and the DMZ is the best recommendation for enhancing security and detecting attacks targeting the organization's public-facing servers.

Attack attempts that could not be recognized by the firewall will be detected if a network- based intrusion detection system is placed between the firewall and the organization’s network. A network-based intrusion detection system placed between the internet and the firewall will detect attack attempts, whether they do or do not enter the firewall.

If a network-based IDS is placed between the Internet and the firewall, it will detect all the attack attempts, whether or not they enter the firewall. If the IDS is placed between a firewall and the corporate network, it will detect those attacks that enter the firewall (it will detect intruders).

B. the demilitarized zone (DMZ).