Which of the following is an intrusion detection system that reads all incoming packets and tries to find suspicious patterns known as signatures or rules?

The correct answer is D. NIDS. NIDS (Network Intrusion Detection System) monitors all incoming network traffic passively, analyzing packets against a database of known attack signatures or rules to detect suspicious activity - matching exactly what the question describes. Why the distractors are wrong: A…

Network Security Controls, Protocols, and Devices

Question

Which of the following is an intrusion detection system that reads all incoming packets and tries to find suspicious patterns known as signatures or rules?

Options

AHIDS
BIPS
CDMZ
DNIDS

How the community answered

(53 responses)

A
6% (3)
B
2% (1)
C
4% (2)
D
89% (47)

Explanation

NIDS (Network Intrusion Detection System) monitors all incoming network traffic passively, analyzing packets against a database of known attack signatures or rules to detect suspicious activity - matching exactly what the question describes.

Why the distractors are wrong:

A. HIDS (Host-based IDS) monitors a single host's logs, files, and processes - not network packets passing through.
B. IPS (Intrusion Prevention System) is similar to NIDS but goes a step further by actively blocking threats, not just detecting them; it also doesn't fit "reads all incoming packets" as a passive listener.
C. DMZ (Demilitarized Zone) is a network architecture concept - a subnet that separates public-facing servers from the internal network - not a detection system at all.

Memory tip: Think N = Network in NIDS. If the question mentions watching network packets for signatures/rules, the answer starts with N. If it mentions a single host or machine, think HIDS. If it blocks rather than just detects, think IPS.

Topics

#Network Intrusion Detection#NIDS#Signature-based Detection#Packet Analysis

Community Discussion

No community discussion yet for this question.

Full 312-38 Practice