English
Menu

Cyber Attacks and Defense in Practice

Which of the following correctly describes the difference between an IDS (intrusion detection system) and an IPS (intrusion prevention system)?

  1. AAn IDS automatically blocks malicious traffic when it finds it, while an IPS only records traffic for later analysis and does not block it
  2. BAn IDS detects suspected attacks and notifies administrators, while an IPS sits in the traffic path and blocks traffic it judges to be malicious
  3. CBoth an IDS and an IPS are mechanisms that automatically distribute and apply programs fixing software vulnerabilities to each internal device
Show answer and explanation

Answer: B. An IDS detects suspected attacks and notifies administrators, while an IPS sits in the traffic path and blocks traffic it judges to be malicious

An IDS monitors network traffic (or activity on endpoints) and raises an alert when it finds a suspected attack. It is often deployed to receive and examine a copy of the traffic, so misjudging normal traffic as an attack does not stop business, but blocking is left to people or other mechanisms. An IPS sits in the traffic path (inline) and can block traffic it judges to be an attack on the spot. In exchange, false positives stop legitimate business traffic, and device failures or processing delays affect all traffic, so the rules used for blocking are tuned carefully.

  • A. The description is reversed. It is the IPS that goes as far as blocking.
  • B. Correct. The IDS detects and notifies, and the IPS sits in the path and goes as far as blocking.
  • C. Distributing fixes is the role of patch management systems.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. Which of the following correctly compares signature-based (misuse) detection and anomaly-based detection as IDS detection methods?
  2. Which of the following correctly describes a WAF (web application firewall)?
  3. An organization places "decoy" files that nobody uses for work, and a decoy administrator account that no system uses, on an internal file server, and monitors access to them. Which of the following is the main advantage of this measure?
  4. The second revision (Rev. 2) of SP 800-61, the incident response guide published by the US NIST in 2012, presents incident response as a cycle of four phases. Which of the following gives the phases in the correct order?
  5. Evidence for an investigation is to be collected from a server where an incident occurred. Which of the following orders is the most appropriate according to the principle of collecting evidence in order of how easily it is lost (order of volatility)?

Comparisons in this topic