What is the primary difference between Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)?

Question

Options

• AIPS identify potentially malicious traffic based on signature or behaviour and IDS does not
• BAn IPS examine network traffic flows to detect and actively stop exploits and attacks
• CIDS are typically deployed behind the firewall and IPS are deployed in front of the firewall
• DOnly IDS is susceptible to false positives

• A
  13% (7)
• B
  79% (41)
• C
  2% (1)
• D
  6% (3)

Explanation

B is correct because it accurately captures the defining characteristic of an IPS: it not only detects malicious traffic (like an IDS does) but also takes active action to block or stop it in real time, inline with the traffic flow.

Why the distractors are wrong:

• A is backwards - both IDS and IPS use signatures and behavioral analysis to identify threats; detection is not exclusive to IPS.
• C reverses the typical deployment - IDS is often placed after the firewall to monitor internal traffic, but this is not a hard rule, and IPS placement varies too; the defining difference is action-taking, not position.
• D is false - both IDS and IPS are susceptible to false positives; neither has immunity.

Memory tip: Think of the letters - Detect (IDS) vs. Prevent (IPS). An IDS is like a security camera that alerts you; an IPS is like a security guard that physically stops the intruder.

No community discussion yet for this question.