Intrusion Detection Systems (IDS) in Computer Networks - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary difference between Network-based IDS and Host-based IDS?

Choose the option that best explains the main difference between Network-based Intrusion Detection Systems (NIDS) and Host-based Intrusion Detection Systems (HIDS).

A NIDS monitors network traffic across multiple devices, while HIDS monitors activities on a single host or device.

B NIDS only detects malware, while HIDS only detects unauthorized user logins.

C NIDS operates only on encrypted traffic, while HIDS operates only on unencrypted traffic.

D NIDS requires installation on each device, while HIDS is deployed on a central network switch.

💡 Hint

Think about where each system collects data from.

Network-based IDS (NIDS) analyzes traffic flowing through the network, monitoring multiple devices at once. Host-based IDS (HIDS) focuses on monitoring a single device's internal activities like file changes or system calls.

📋 Factual

intermediate

Which IDS detection method relies on known attack patterns?

Identify the IDS detection method that uses predefined signatures or patterns of known attacks to detect intrusions.

A Anomaly-based detection

B Signature-based detection

C Heuristic-based detection

D Behavior-based detection

💡 Hint

It matches traffic against a database of known threats.

Signature-based detection compares network or system activity against a database of known attack signatures to identify threats.

🔍 Analysis

advanced

What is a major limitation of anomaly-based IDS?

Analyze the following options and select the major limitation commonly associated with anomaly-based Intrusion Detection Systems.

A They often generate a high number of false positives.

B They cannot detect new or unknown attacks.

C They require constant updates of attack signatures.

D They only monitor network traffic, not host activity.

💡 Hint

Consider what happens when normal behavior varies a lot.

Anomaly-based IDS detects deviations from normal behavior, which can lead to many false alarms when unusual but harmless activities occur.

❓ Comparison

advanced

Compare IDS and IPS in terms of response to detected threats.

Which statement correctly compares how Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) respond to threats?

A Both IDS and IPS only alert administrators without blocking threats.

B IDS blocks threats automatically; IPS only logs threats for review.

C IDS and IPS are the same and both block threats automatically.

D IDS detects and alerts but does not block threats; IPS detects and actively blocks threats.

💡 Hint

Think about whether the system takes action or just informs.

IDS monitors and alerts about suspicious activity but does not block it. IPS can detect and also take immediate action to block or prevent the threat.

❓ Reasoning

expert

Why might an organization choose a hybrid IDS approach?

Consider the benefits and drawbacks of different IDS types. Why would an organization implement both Network-based and Host-based IDS together?

A To avoid the need for any manual monitoring by administrators.

B Because Host-based IDS is cheaper and can replace Network-based IDS entirely.

C To combine broad network monitoring with detailed host activity analysis for better threat detection.

D Because Network-based IDS cannot detect any threats without Host-based IDS.

💡 Hint

Think about coverage and depth of monitoring.

A hybrid approach uses Network-based IDS to monitor traffic across the network and Host-based IDS to analyze detailed activities on individual devices, improving overall detection accuracy and coverage.