Intrusion Detection and Prevention Systems (IDPS)

Correct Answer: Network-based Intrusion Prevention System (NIPS)

The Network-based Intrusion Prevention System (NIPS) is the correct answer. It can detect and attempt to stop malicious activities like a SYN flood attack on a network. NIPS actively analyze network traffic to detect threats and then take the necessary preventative measures to mitigate them, hence it is the required security system against such attacks. The Host-based Intrusion Detection System (HIDS) operate on individual hosts or devices on the network which makes them unsuitable for wide network attacks like SYN floods. Signature-based Intrusion Detection System (SIDS) simply recognizes patterns related to known threats which may not include diverse or novel SYN flood methods. Lastly, a Vulnerability scanner only identifies potential vulnerabilities in a networked system and does not stop active attacks. Therefore, it would not prevent a SYN flood attack.

Correct Answer: Network-based Intrusion Detection System (NIDS)

A Network-based Intrusion Detection System (NIDS) is the best option here. This is because NIDSs are perfect for businesses experiencing rapid growth as they have the ability to monitor the entire network for malicious activity or policy violations, not just individual systems. Additionally, NIDS can be more cost-effective as they do not require components to be installed on every device. On the other hand, Installing a HIDS on every device might not be feasible or cost-effective as the network grows. Deploying an advanced honeypot is a decoy approach to trap attackers, it doesn't provide comprehensive network security. Additionally, further segmenting the network may enhance security by limiting an intruder's access to parts of the network, but will not alert the company to an intrusion like NIDS does.

Correct Answer: Tune the IDS to reduce false positives

The best course of action would be to 'Tune the IDS to reduce false positives'. An Intrusion Detection System (IDS) is designed to detect suspicious activity, but if it's overly sensitive, it can flag legitimate traffic as suspicious (false positives) which seems to be the problem in this scenario. Tuning the IDS configuration would involve reviewing and modifying the criteria that it uses to identify suspicious activity, with the aim of making it more accurately distinguish between legitimate and potentially harmful network traffic. This should help resolve the slow network performance and the issue of legitimate traffic being unnecessarily blocked 'Disable the IDS' is not a good solution because whilst it might quickly restore network performance, it would leave the network unprotected from the very real threats that the IDS is designed to guard against 'Disable outbound network traffic' will effectively cut the network off from the internet, which may not be a feasible option in most business environments Lastly, 'Change firewall settings to allow all traffic' is not a viable solution because it leaves the network vulnerable to any threats since it removes all filtering of incoming traffic.