CompTIA Security+ SY0-701 Practice Question

Placing a network-based intrusion prevention system directly behind the external firewall, yet in front of the internal routing mechanisms, enables the IPS to inspect and potentially act upon malicious traffic that has been permitted by the external firewall, but before it can reach vital internal systems. This position leverages the filtration already done by the firewall, allowing the IPS to operate more effectively and with reduced exposure to irrelevant external noise. Positioning the IPS outside of the firewall exposes it to large volumes of traffic, lessening its efficiency and increasing the possibility of false positives. Embedding it inside the LAN, near user workstations, or at the datacenter ingress might hinder performance due to potentially vast internal traffic and could allow threats through the firewall to spread before being detected.