What device typically sits at a network perimeter to detect command and control and other potentially suspicious traffic?

Question

Options

• AHost-based firewall
• BWeb proxy
• CEndpoint Detection and Response
• DIntrusion Detection System

• B
  4% (2)
• C
  2% (1)
• D
  94% (49)

Explanation

An Intrusion Detection System (IDS) is specifically designed to sit at the network perimeter and monitor traffic for malicious patterns, including command and control (C2) communications - the hallmark of botnet and malware activity. It inspects packets passively and generates alerts when suspicious signatures or behaviors are detected.

Why the distractors are wrong:

• A. Host-based firewall - operates on individual endpoints to filter traffic by port/protocol rules; it doesn't analyze traffic content for C2 patterns at the network level.
• B. Web proxy - sits in the traffic path to filter and cache web requests, but its primary role is policy enforcement and content filtering, not threat detection.
• C. Endpoint Detection and Response (EDR) - runs on individual hosts to detect suspicious process behavior and file activity; it is host-centric, not a perimeter device.

Memory tip: Think IDS = "I Detect Suspicious" traffic at the border. The key phrase in the question is "network perimeter" + "detect" - IDS owns both of those words. If the question said "block" instead of "detect," you'd pivot to IPS (Intrusion Prevention System).

No community discussion yet for this question.