Cisco Cyber Security Practice Exam

Which system passively monitors network traffic without interfering with it?

1. IPS

2. IDS

3. Firewall

4. Proxy server

The correct answer is: IDS

An Intrusion Detection System (IDS) is designed to passively monitor network traffic for the purpose of identifying suspicious activities or policy violations. Unlike an Intrusion Prevention System (IPS), which actively blocks or prevents identified threats in real-time, an IDS simply observes and analyzes the data flowing through the network. It generates alerts or notifications when potential threats are detected, allowing network administrators to take action based on that data without impacting the current traffic flow. The primary function of an IDS centers on surveillance and logging, providing insights into network activities without directly influencing them. This characteristic is crucial for environments where data integrity and continuity are vital, as it ensures that normal operations are not disrupted by automated countermeasures. In contrast, systems like firewalls and proxy servers are designed to actively manage and control network traffic, either by allowing or blocking such traffic based on predetermined security policies, which means they do not fit the criterion of passive monitoring. The approach of an IDS offers a layer of security through visibility and awareness, which is fundamental in cybersecurity practices.