What is the primary purpose of an Intrusion Detection System (IDS)?

• A. A specialized software used for detecting ongoing intrusions
• B. A firewall that blocks traffic by default
• C. A router that forwards packets
• D. An encryption tool for securing data

Answer: (A)

An intrusion detection system is designed to monitor network traffic or host activity for signs of unauthorized access or policy violations and to alert security personnel when such activity is detected. It can be network-based, inspecting traffic on a segment, or host-based, watching a single machine’s behavior. Detection methods include signature-based detection, which looks for known attack patterns, and anomaly-based detection, which flags deviations from normal behavior. The value lies in giving timely alerts and logs to support incident response and forensics; it does not by itself block traffic. By contrast, a firewall enforces access control by blocking or allowing traffic, a router simply forwards packets, and an encryption tool secures data but does not detect intrusions.