ITPEC FE Subject A October 2025 Question 31

It monitors a server or network and notifies the administrator of an intrusion — IDS stands for Intrusion Detection System.

An IDS watches network traffic (network-based IDS) or activity on a host (host-based IDS), compares it with attack signatures or normal behaviour, and raises an alert when it detects an intrusion or policy violation. Detecting and alerting is its job; blocking the traffic is the job of an IPS (Intrusion Prevention System).

Answer (c)

Why not others:

• •(a) — checking that installed software is the latest version is a software asset or patch management function.
• •(b) — collecting the state of security measures and company information to self-diagnose an organisation's security activities describes a security self-assessment tool such as a security benchmark.
• •(d) — sending test data to a product and finding vulnerabilities from its responses is fuzzing, a vulnerability testing technique.

Key rule: IDS detects and alerts, IPS detects and blocks, and neither assesses vulnerabilities in advance; that is scanning, fuzzing or penetration testing.

Security · AI-written, may contain errors