Which statement most accurately contrasts a network intrusion detection system with a network intrusion prevention system as they are typically deployed at an enterprise perimeter?
- AAn IDS only inspects encrypted traffic after termination at a proxy, while an IPS inspects unencrypted traffic at layer two before any routing decision is made.
- BAn IDS uses behavioural analytics exclusively, while an IPS uses signature matching exclusively, so the two technologies cannot share rule sets.
- CAn IDS is a host-resident agent that protects a single endpoint, while an IPS is always a dedicated network appliance that protects a whole subnet.
- DAn IDS inspects traffic out of band and raises alerts on suspicious patterns, while an IPS sits inline so it can drop or reset sessions that match a signature or behavioural rule. Correct
Why A is wrong: It is tempting because encryption inspection is a real design concern, but the protocol layer and TLS handling are not what separates the two technologies. Either can be deployed alongside a decrypting proxy, and both typically inspect at layers three through seven.
Why B is wrong: Candidates may recall that anomaly detection appears in IDS marketing, yet both product types commonly combine signatures, protocol analysis, and behavioural heuristics, and many vendors ship a single engine that can be run in either mode.
Why C is wrong: Host versus network is a separate axis from detection versus prevention. Host-based IDS and host-based IPS both exist, as do network IDS and network IPS, so this framing confuses two independent classifications.
Why D is correct: This captures the defining difference: placement and authority. An IDS observes a copy of traffic and notifies analysts, whereas an IPS is in the forwarding path and can actively block matching flows in real time.