Intrusion detection systems (IDS)
Name:
Date:
Class:
A
Quick Questions
Shade in the A or B circle for each question.
1. Does an IDS monitor network traffic for suspicious activity?
2. Does an IDS block traffic itself?
3. Can an IDS use signature-based detection?
4. Can an IDS use anomaly-based detection?
5. Does an IDS raise an alert when it finds a match or anomaly?
B
Match the Pairs
Draw a line connecting each item on the left to its match on the right.
| Left column | Right column | |
|---|---|---|
| 1IDS | AWrong - an IDS can also use signature-based detection | |
| 2Signature-based detection | BWrong - an IDS only alerts, it does not block traffic | |
| 3Flagging traffic that doesn't match normal behaviour | CAlerting without blocking | |
| 4Detecting suspicious activity without stopping it | DAnomaly-based detection | |
| 5An IDS blocks malicious traffic automatically | EMonitors network traffic for suspicious activity and raises an alert | |
| 6An IDS only detects threats using anomaly-based methods | FMatching traffic against known attack patterns |
C
Definitions
Intrusion detection system (IDS)
D
Fill in the Blanks
Complete each line of code by filling in the missing parts.
1.
An IDS ________ network traffic
2.
An IDS raises an _____
when it detects a threat
3.
IDS uses signature-based _________
4.
IDS can also use _____________ detection
5.
An IDS never ______ traffic itself
E
Spot the Error
Shade in the letter of the line that contains an error.
Question 1
A
IDS blocks all traffic
B
IDS monitors traffic
C
IDS raises alerts
Question 2
A
IDS watches traffic
B
IDS blocks traffic
C
IDS sends an alert
Question 3
A
IDS spots suspicious activity
B
IDS raises an alert
C
IDS deletes bad files
Question 4
A
Signature IDS matches patterns
B
Anomaly IDS flags odd traffic
C
IDS raises alerts on matches
D
IDS never detects new threats
Question 5
A
IDS monitors network flow
B
IDS compares to known patterns
C
IDS raises an alert
D
It does not block traffic
E
IDS never checks anomalies
Answer Key
Intrusion detection systems (IDS)
Section A: Quick Questions
Q1
B — Yes
Q2
A — No
Q3
A — Yes
Q4
A — Yes
Q5
B — Yes
Section B: Match the Pairs
Q1
IDS → Monitors network traffic for suspicious activity and raises an alert
Q2
Signature-based detection → Matching traffic against known attack patterns
Q3
Flagging traffic that doesn't match normal behaviour → Anomaly-based detection
Q4
Detecting suspicious activity without stopping it → Alerting without blocking
Q5
An IDS blocks malicious traffic automatically → Wrong - an IDS only alerts, it does not block traffic
Q6
An IDS only detects threats using anomaly-based methods → Wrong - an IDS can also use signature-based detection
Section C: Definitions
Q1
Intrusion detection system (IDS) — A system that monitors network traffic for suspicious activity and raises an alert when it finds it.Section D: Fill in the Blanks
Q1
An IDS monitors network trafficQ2
An IDS raises an alert
when it detects a threatQ3
IDS uses signature-based detectionQ4
IDS can also use anomaly-based detectionQ5
An IDS never blocks traffic itselfSection E: Spot the Error
Q1
A — An IDS does not block traffic - it only monitors and alerts.
Q2
B — Blocking traffic is not an IDS's job - it only alerts.
Q3
C — Deleting files is not an IDS's function - it detects and alerts.
Q4
D — Anomaly-based IDS can detect new, previously unseen threats.
Q5
E — Anomaly-based IDS does check for unusual, anomalous behaviour.