A manufacturing company implemented IoT devices throughout their smart factory and needs a security solution that meets these requirements: Protect…

An Intrusion Prevention/Detection System (IPS/IDS) is the most suitable technology to meet the specified requirements. It actively monitors network traffic for malicious activity and policy violations. Modern IPS/IDS solutions provide deep packet inspection to protect against network-based attacks, offer detailed visibility into application and communication patterns, and use behavioral analysis and baselining to perform anomaly detection. This is crucial for IoT environments where traffic is often predictable, making deviations from the norm a strong indicator of a compromise or attack. While often integrated into Next-Generation Firewalls (NGFWs), the core technology that provides these specific functions is the IPS/IDS engine.

A. zone-based firewall: A zone-based firewall provides stateful inspection and segmentation but lacks the advanced deep packet inspection and behavioral analysis needed for anomaly detection.

B. transparent firewall: A transparent firewall simplifies deployment at Layer 2 but does not inherently provide the required visibility, anomaly detection, or advanced threat protection capabilities.

C. traditional firewall: A traditional firewall is limited to Layer 3/4 filtering (IP addresses and ports) and cannot perform the deep inspection or anomaly detection required for modern IoT threats.

1. Cisco, Cisco ISA 3000 Series Ruggedized Appliances Data Sheet. "Threat detection and mitigation with Cisco Firewall Intrusion Prevention System (IPS) and security intelligence feeds." This document explicitly states that the industrial appliance designed for environments like smart factories uses an IPS for threat detection, which is a core requirement.

2. Cisco, Deploying Cisco Cyber Vision with the Cisco Secure Firewall, Document ID: 724151, Section: "Introduction to the Solution". "Cisco Cyber Vision is a cybersecurity solution specific to Industrial Control Systems (ICS) that provides visibility and threat detection... The Cisco Secure Firewall with its Intrusion Prevention System (IPS) powered by Snort 3 can then be used to segment the industrial network and block threats." This guide shows that for IoT/ICS visibility and anomaly detection (Cyber Vision), the enforcement and protection mechanism is the firewall's IPS.

3. Cisco, Cisco Secure Firewall Threat Defense Configuration Guide for Firepower Device Manager, Version 7.2, Chapter: "Intrusion Policies". "Intrusion policies are the system's last line of defense before traffic is allowed to its destination... The system uses the intrusion policy to examine traffic for security violations and, in inline deployments, can block or alter malicious traffic." This official configuration guide details how the IPS component is responsible for examining traffic for security violations, which aligns with the requirement to protect against network-based attacks and detect anomalies.