Which of the following BEST describes the implications of placing an IDS device inside or outside of the corporate firewall?

Question

Options

• APlacing the IDS device inside the firewall will allow it to monitor potential internal attacks but may
• BPlacing the IDS device outside the firewall will allow it to monitor potential remote attacks while
• CPlacing the IDS device inside the firewall will allow it to monitor potential remote attacks but may
• DPlacing the IDS device outside the firewall will allow it to monitor potential remote attacks but the

• A
  7% (2)
• B
  85% (23)
• C
  4% (1)
• D
  4% (1)

Explanation

Placing an IDS outside the firewall means it sees all inbound internet traffic before the firewall filters it. This lets it monitor and alert on all external attack attempts - including those the firewall would block - giving broader visibility into the threat landscape and attacker behavior. An IDS placed inside the firewall only sees traffic that has already passed through the firewall's filters, missing the full volume of external attacks. The trade-off for outside placement is that it generates higher alert volume (more noise) since it sees all unfiltered traffic. Answer B correctly captures the advantage of outside placement (visibility into remote attacks) and implicitly acknowledges that placement context matters for what the IDS can detect.

No community discussion yet for this question.