Which of the following BEST describes the implications of placing an IDS device inside or outside of the corporate firewall?

An IDS inside the firewall monitors traffic that has already been filtered, so it sees internal threats and attacks that bypass the firewall, but it misses the broader external attack surface visible to an outside-placed sensor.

Placing an IDS outside the firewall means it inspects the full volume of inbound internet traffic before any filtering occurs, enabling detection of remote and external attacks and providing complete visibility into attack attempts against the organization. This placement also reveals attacker reconnaissance and probing activity that the firewall would otherwise silently drop. However, it offers no visibility into internal lateral movement or threats that originate inside the network perimeter.

An IDS inside the firewall does not effectively monitor remote attacks because the firewall has already filtered most inbound external traffic before the IDS can inspect it.

This choice mischaracterizes the trade-offs of outside-firewall placement; the specific limitation it attributes to this configuration does not accurately reflect standard IDS deployment behavior.