Ethical Hacking Essentials Practice Test

What do IDS and IPS systems do when malicious traffic enters a target machine or server?

1. Drop the packets

2. Raise alarms

3. Log the traffic

4. Redirect traffic

The correct answer is: Raise alarms

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) serve critical roles in network security when it comes to handling malicious traffic. An IDS is designed to monitor network traffic and identify potential threats by analyzing patterns and signatures of malicious activities. When such activity is detected, the system will typically raise alarms to alert administrators about the potential intrusion, enabling a rapid response to the threat. On the other hand, while both systems may log the traffic for further analysis, the primary focus of an IDS is on detection, which involves raising alerts rather than taking direct action like blocking or dropping packets. This distinction is essential, as the purpose of an IDS is to inform and allow for human intervention. In summary, the role of raising alarms for malicious traffic aligns with the primary function of an IDS, supporting security teams in keeping networks safe by providing critical visibility into potential threats. Logging, while also a function, is secondary to the priority of alerting security personnel so they can respond accordingly.