Exam 350-201 topic 1 question 39 discussion

Move the IPS to before the firewall facing the outside network.

Moving the Intrusion Prevention System (IPS) before the firewall facing the outside network is a strategic action to harden the network. This placement allows the IPS to analyze and filter incoming traffic before it reaches the firewall, providing an additional layer of security. By positioning the IPS externally, it can prevent malicious traffic from ever reaching the internal network devices, thus reducing the number of false positives generated by trusted IP addresses and internal devices1.

Based on the given scenario, the recommended action to harden the network would be to move the IPS to after the firewall facing the internal network. This is because the incident log showed that the alerts were from trusted IP addresses and internal devices, which implies that the alerts were not related to any external attacks. By moving the IPS after the firewall facing the internal network, it will help to reduce the number of false positives from trusted sources and improve the accuracy of intrusion detection. - ChatGPT

IDS/IPS should be in place before the firewall as a filter before the traffic ever hits the firewall. The main reason for this is to save resources for the firewall since the IDS/IPS, if active, will prevent many types of malicious traffic and attacks before the firewall is ever hit. Filter closest to the source. The goal with IDS/IPS is to filter incoming traffic, even though it is effective for outgoing traffic also

B is right answer.