Where are IDS sensors commonly placed to monitor traffic?

• A. On routers or in DMZs for high-risk networks
• B. On endpoints only
• C. Inside application code
• D. In a cloud proxy only

Answer: (A)

IDS sensors are placed where they can see traffic as it enters or leaves a network, providing broad visibility of flows at the network edge. Placing them on routers or in a DMZ lets you monitor traffic between untrusted networks (like the internet) and the protected network, especially for high-risk environments with exposed services. This position catches scanning, exploits, and other malicious activity early and across many hosts, without needing to install sensors on every device.

Putting sensors only on endpoints limits visibility to individual machines and misses many network-wide attacks or lateral movement. Placing sensors inside application code isn’t how IDS visibility is achieved, and relying on a cloud proxy alone may miss non-proxy traffic and internal communications.