Intrusion Detection Systems (IDS) in Computer Networks - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary difference between Network-based IDS and Host-based IDS?

Choose the option that best explains the main difference between Network-based Intrusion Detection Systems (NIDS) and Host-based Intrusion Detection Systems (HIDS).

A NIDS monitors network traffic across multiple devices, while HIDS monitors activities on a single host or device.

B NIDS only detects malware, while HIDS only detects unauthorized user logins.

C NIDS operates only on encrypted traffic, while HIDS operates only on unencrypted traffic.

D NIDS requires installation on each device, while HIDS is deployed on a central network switch.

💡 Hint

Think about where each system collects data from.

Network-based IDS (NIDS) analyzes traffic flowing through the network, monitoring multiple devices at once. Host-based IDS (HIDS) focuses on monitoring a single device's internal activities like file changes or system calls.

📋 Factual

intermediate

Which IDS detection method relies on known attack patterns?

Identify the IDS detection method that uses predefined signatures or patterns of known attacks to detect intrusions.

A Anomaly-based detection

B Signature-based detection

C Heuristic-based detection

D Behavior-based detection

💡 Hint

It matches traffic against a database of known threats.

Signature-based detection compares network or system activity against a database of known attack signatures to identify threats.

🔍 Analysis

advanced

What is a major limitation of anomaly-based IDS?

Analyze the following options and select the major limitation commonly associated with anomaly-based Intrusion Detection Systems.

A They often generate a high number of false positives.

B They cannot detect new or unknown attacks.

C They require constant updates of attack signatures.

D They only monitor network traffic, not host activity.

💡 Hint

Consider what happens when normal behavior varies a lot.

Anomaly-based IDS detects deviations from normal behavior, which can lead to many false alarms when unusual but harmless activities occur.

❓ Comparison

advanced

Compare IDS and IPS in terms of response to detected threats.

Which statement correctly compares how Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) respond to threats?

A Both IDS and IPS only alert administrators without blocking threats.

B IDS blocks threats automatically; IPS only logs threats for review.

C IDS and IPS are the same and both block threats automatically.

D IDS detects and alerts but does not block threats; IPS detects and actively blocks threats.

💡 Hint

Think about whether the system takes action or just informs.

IDS monitors and alerts about suspicious activity but does not block it. IPS can detect and also take immediate action to block or prevent the threat.

❓ Reasoning

expert

Why might an organization choose a hybrid IDS approach?

Consider the benefits and drawbacks of different IDS types. Why would an organization implement both Network-based and Host-based IDS together?

A To avoid the need for any manual monitoring by administrators.

B Because Host-based IDS is cheaper and can replace Network-based IDS entirely.

C To combine broad network monitoring with detailed host activity analysis for better threat detection.

D Because Network-based IDS cannot detect any threats without Host-based IDS.

💡 Hint

Think about coverage and depth of monitoring.

A hybrid approach uses Network-based IDS to monitor traffic across the network and Host-based IDS to analyze detailed activities on individual devices, improving overall detection accuracy and coverage.

Practice

1. What is the primary role of an Intrusion Detection System (IDS)?

easy

A. To replace firewalls in network security

B. To block all incoming network traffic automatically

C. To encrypt data transmitted over the network

D. To monitor network or system activity and alert on suspicious behavior

Solution

1. Step 1: Understand IDS function

   An IDS monitors network or system activity to detect suspicious or malicious behavior.

2. Step 2: Differentiate IDS from other tools

   Unlike firewalls or antivirus, IDS does not block attacks but alerts administrators.

3. Final Answer:

   To monitor network or system activity and alert on suspicious behavior -> Option D

4. Quick Check:

   IDS alerts suspicious activity [OK]

Hint: IDS alerts but does not block attacks [OK]

Common Mistakes:

• Confusing IDS with firewall functions
• Thinking IDS blocks attacks automatically
• Assuming IDS encrypts data

2. Which of the following is a correct description of a Network-based IDS (NIDS)?

easy

A. Blocks suspicious packets automatically

B. Monitors traffic on a specific host only

C. Monitors network traffic for multiple devices

D. Encrypts network data to prevent attacks

Solution

1. Step 1: Define Network-based IDS

   NIDS monitors network traffic across multiple devices by analyzing packets on the network.

2. Step 2: Compare with other options

   It does not monitor a single host only, nor does it block or encrypt traffic.

3. Final Answer:

   Monitors network traffic for multiple devices -> Option C

4. Quick Check:

   NIDS watches network traffic [OK]

Hint: NIDS watches network traffic, not just one device [OK]

Common Mistakes:

• Confusing NIDS with Host-based IDS
• Thinking NIDS blocks traffic
• Assuming NIDS encrypts data

3. Consider this scenario: An IDS detects unusual traffic patterns and sends an alert. What will happen next?

medium

A. The IDS automatically blocks the suspicious traffic

B. The IDS logs the event and alerts the administrator

C. The IDS shuts down the affected system

D. The IDS encrypts the suspicious traffic

Solution

1. Step 1: Understand IDS response to detection

   When IDS detects suspicious activity, it logs the event and alerts the administrator for review.

2. Step 2: Clarify IDS capabilities

   IDS does not block traffic, shut down systems, or encrypt data automatically.

3. Final Answer:

   The IDS logs the event and alerts the administrator -> Option B

4. Quick Check:

   IDS alerts and logs, no blocking [OK]

Hint: IDS alerts and logs, does not block [OK]

Common Mistakes:

• Assuming IDS blocks attacks automatically
• Thinking IDS controls system shutdown
• Confusing IDS with encryption tools

4. A system administrator configures an IDS but notices it is not alerting on suspicious activity. What is the most likely cause?

medium

A. The IDS signature database is outdated or missing

B. The IDS is blocking all traffic instead of alerting

C. The IDS is encrypting alerts, so they are hidden

D. The IDS is shutting down the network interface

Solution

1. Step 1: Identify common IDS issues

   If IDS does not alert, a common cause is an outdated or missing signature database that detects threats.

2. Step 2: Eliminate other causes

   IDS does not block traffic, encrypt alerts, or shut down interfaces by default.

3. Final Answer:

   The IDS signature database is outdated or missing -> Option A

4. Quick Check:

   Outdated signatures cause no alerts [OK]

Hint: Check IDS signature updates if no alerts appear [OK]

Common Mistakes:

• Thinking IDS blocks traffic by default
• Assuming IDS encrypts alerts
• Believing IDS disables network interfaces

5. An organization wants to detect unauthorized access attempts on individual computers and also monitor overall network traffic for attacks. Which IDS deployment strategy should they use?

hard

A. Deploy both Host-based IDS (HIDS) on computers and Network-based IDS (NIDS) on the network

B. Use only Network-based IDS (NIDS) to cover all devices

C. Use only Host-based IDS (HIDS) on critical servers

D. Replace IDS with a firewall for better protection

Solution

1. Step 1: Understand IDS types and coverage

   Host-based IDS (HIDS) monitors individual computers, while Network-based IDS (NIDS) monitors network traffic across devices.

2. Step 2: Match organization's needs

   To detect unauthorized access on computers and monitor network attacks, both HIDS and NIDS should be deployed together.

3. Final Answer:

   Deploy both Host-based IDS (HIDS) on computers and Network-based IDS (NIDS) on the network -> Option A

4. Quick Check:

   Use HIDS + NIDS for full coverage [OK]

Hint: Combine HIDS and NIDS for full protection [OK]

Common Mistakes:

• Using only one IDS type for all needs
• Replacing IDS with firewall only
• Ignoring host-level monitoring