Intrusion Detection Systems (IDS) in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is an Intrusion Detection System (IDS)?

An IDS is a security tool that monitors network or system activities for malicious actions or policy violations and alerts administrators when suspicious activity is detected.

beginner

Name the two main types of IDS based on deployment location.

The two main types are Network-based IDS (NIDS), which monitors network traffic, and Host-based IDS (HIDS), which monitors activities on individual devices.

intermediate

How does signature-based IDS detect threats?

Signature-based IDS detects threats by comparing network or system activity against a database of known attack patterns or signatures.

intermediate

What is the main difference between IDS and IPS?

IDS detects and alerts about suspicious activity but does not block it, while Intrusion Prevention Systems (IPS) can detect and actively block or prevent attacks.

intermediate

Why is false positive reduction important in IDS?

Reducing false positives is important because too many incorrect alerts can overwhelm security teams, causing real threats to be missed or ignored.

Which type of IDS monitors traffic on a network?

A Anomaly-based IDS

B Host-based IDS

C Signature-based IDS

D Network-based IDS

Network-based IDS (NIDS) monitors network traffic to detect suspicious activity.

What does a signature-based IDS rely on to detect attacks?

A Random sampling

B Known attack patterns

C User behavior analysis

D Encryption keys

Signature-based IDS uses a database of known attack patterns to identify threats.

Which of the following is NOT a function of an IDS?

A Blocking attacks automatically

B Alerting administrators about suspicious activity

C Monitoring system logs

D Detecting policy violations

IDS alerts but does not block attacks; blocking is done by IPS.

What is a common challenge when using IDS?

A Lack of network access

B Inability to monitor logs

C Too many false positives

D No alerts generated

False positives cause many incorrect alerts, making it hard to focus on real threats.

Host-based IDS primarily monitors:

A Individual device activities

B Internet traffic

C Firewall settings

D Email servers

Host-based IDS watches activities on a single device to detect suspicious behavior.

Explain the difference between Network-based IDS and Host-based IDS.

Think about where the IDS is placed and what it watches.

Describe how signature-based and anomaly-based IDS differ in detecting threats.

Consider how each method identifies suspicious activity.