GSLC · Question #498
Which of the following components are usually found in an Intrusion detection system (IDS)? Each correct answer represents a complete solution. Choose two.
The correct answer is A. Console E. Sensor. A standard IDS architecture is built around two primary components - sensors that detect and analyze activity, and a console that provides centralized management and alert visibility.
Question
Which of the following components are usually found in an Intrusion detection system (IDS)? Each correct answer represents a complete solution. Choose two.
Options
- AConsole
- BFirewall
- CModem
- DGateway
- ESensor
How the community answered
(26 responses)- A85% (22)
- B4% (1)
- C4% (1)
- D8% (2)
Why each option
A standard IDS architecture is built around two primary components - sensors that detect and analyze activity, and a console that provides centralized management and alert visibility.
The console is the centralized management and display interface of an IDS; it receives alerts generated by sensors, allows administrators to configure detection policies, and presents a unified view of security events across the monitored environment.
A firewall is an independent network security device that enforces traffic filtering rules; while often deployed alongside an IDS, it is not an internal component of the IDS itself.
A modem is a physical signal-conversion device used to connect to a network; it plays no role in the detection, analysis, or management functions of an IDS.
A gateway is a network routing node that connects different networks; it is not a functional building block within IDS architecture.
Sensors are the active detection components of an IDS that monitor network traffic or host activity, compare it against signatures or behavioral baselines, and forward alerts to the console when anomalies or known attack patterns are detected.
Concept tested: IDS architecture core components - sensor and console
Source: https://csrc.nist.gov/publications/detail/sp/800-94/final
Topics
Community Discussion
No community discussion yet for this question.