IPA IP 2023 Question 67
A question IPA Japan published in 令和5年度 ITパスポート試験 公開問題 問67, translated into English. ITPEC is based on the same exams.
Which of the following is an appropriate role of an IDS that is used in a network environment?
Explanation
It detects unauthorized access and its signs, and notifies the administrator — an IDS (Intrusion Detection System) watches traffic or logs for attacks and raises an alert.
A network IDS examines the packets flowing on a network and compares them with known attack patterns (signatures) or with normal behaviour, flagging what looks like an intrusion or the preparation for one, such as a port scan. It only detects and reports; blocking the traffic is the job of an IPS (Intrusion Prevention System) or a firewall.
Answer (c)
Why not others:
- •(a) — converting between IP addresses and domain names is DNS
- •(b) — synchronizing the clocks of computers on a network is NTP
- •(d) — delivering mail from a mail server to a mail client is done by POP or IMAP
Key rule: An IDS detects and alerts, an IPS detects and blocks, and a firewall filters traffic by rules set in advance.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.