Security monitoring: Which task is NOT performed by an intrusion detection system (IDS)?
-
AIdentify attempts to hack into a system.
-
BMonitor packets traversing the network for suspicious patterns.
-
CTransmit message packets to their correct destination (routing).
-
DDeploy deception mechanisms such as honeypots or traps.
-
EAlert administrators when anomalies are detected.
Answer
Correct Answer: Transmit message packets to their correct destination (routing).
Explanation
Introduction / Context:An intrusion detection system (IDS) observes activity to detect malicious behavior. It can operate on hosts or networks, analyzing logs, processes, or packet streams to flag anomalies and known attack signatures.
Given Data / Assumptions:
- IDS focuses on detection, alerting, and sometimes limited response.
- Routing and packet forwarding are functions of network devices (routers, switches), not IDS.
- Some solutions include deception components (honeypots) to study attacker behavior.
Concept / Approach:Distinguish between security monitoring (observe, detect, alert) and transport functions (forwarding packets). IDS tools like Snort/Suricata analyze traffic but do not act as routers.
Step-by-Step Solution:
List typical IDS capabilities: detection, logging, alerting, sometimes deception.Contrast with routing, which is a network layer duty.Identify routing as out-of-scope for an IDS.Verification / Alternative check:Product documentation for IDS solutions shows packet capture and analysis roles, not forwarding decisions beyond passive monitoring.
Why Other Options Are Wrong:
- Detection, monitoring, and alerting are central IDS functions.
- Deception components may be integrated in broader security platforms.
Common Pitfalls:Confusing IDS with IPS (intrusion prevention system). IPS may drop or block traffic but still does not replace routers.
Final Answer:Transmit message packets to their correct destination (routing).