Questions: Intrusion Detection and Prevention Systems

Question 1

An IPS blocks a legitimate database query because it matches a SQL injection signature. What fundamental tradeoff does this illustrate about IPS deployment?

• A. Signature-based detection cannot identify novel zero-day attacks
• B. Inline placement makes the IPS a network bottleneck under heavy traffic
• C. IPS false positives actively block legitimate traffic, whereas IDS false positives generate alerts without disruption — the inline position turns detection errors into operational outages
• D. Anomaly-based detection has higher false positive rates than signature-based detection

Answer: (C)

The critical difference between IDS and IPS is what happens on a false positive. An IDS monitors a copy of traffic and generates alerts — a false positive wastes analyst time but causes no operational harm. An IPS sits inline; when it misidentifies legitimate traffic as malicious, it actively drops or blocks that traffic, potentially halting business operations. This asymmetry means IPS systems require careful tuning before being placed in blocking mode, and operators often run IPS in 'detection only' mode first to characterize the false positive rate.

Question 2

A web server allows HTTP traffic on port 80. A properly configured firewall permits this traffic. Why does the organization still need an IDS/IPS?

• A. Firewalls are hardware devices and cannot be updated with new security rules quickly enough
• B. Firewalls enforce policies about who can communicate with whom, but cannot inspect payload content — a SQL injection attack embedded in a valid HTTP request passes freely through a firewall
• C. IDS/IPS monitors network traffic for performance degradation that firewalls ignore
• D. Firewalls only work at the network perimeter, while IDS/IPS also monitor internal traffic

Answer: (B)

Firewalls operate at the network/transport layer, filtering by IP address, port, and protocol. They are blind to the content of permitted traffic. A SQL injection attack, a cross-site scripting payload, or malware download embedded in an HTTP request is invisible to a firewall that allows HTTP on port 80. IDS/IPS perform deep packet inspection, analyzing payload content and behavioral patterns to detect malicious activity within otherwise permitted sessions. Firewalls and IDS/IPS are complementary controls, not substitutes.

Question 3

Anomaly-based IDS is strictly superior to signature-based IDS because it can detect novel attacks that have no known signature.

• T. True
• F. False

Answer: False

Anomaly-based detection has a critical weakness: it generates many false positives. Any legitimate but unusual activity — a backup job at an unexpected time, a software update causing a traffic spike, a new application deployment — can look anomalous against the learned baseline. Signature-based detection is highly accurate for known attack patterns (low false positives) but blind to new ones. Neither approach dominates the other; they address different threat classes. Production security systems deploy both, feeding alerts into a SIEM for correlation.

Question 4

A network-based IDS (NIDS) can detect attacks concealed within TLS-encrypted HTTPS traffic by performing signature matching on the packet payloads.

• T. True
• F. False

Answer: False

Encrypted traffic is opaque to NIDS payload inspection. TLS encrypts the application-layer content so that only the endpoints (client and server) can read it. A NIDS sees only ciphertext in the payload and cannot apply signature-based rules to it. NIDS can still analyze metadata — connection timing, volume, source/destination patterns — but payload signatures are ineffective against encrypted traffic. Host-based IDS (HIDS), running on the server, can inspect traffic after decryption at the application layer and is not subject to this limitation.

Question 5

Explain the difference between IDS and IPS in terms of network placement and what this means for both their defensive capability and operational risk.

Model answer: An IDS monitors a *copy* of network traffic — delivered via a network tap or switch port mirror — and operates out-of-band. It can generate alerts but cannot block anything. An IPS sits *inline* on the network path, meaning all traffic physically flows through it. When the IPS identifies malicious traffic, it can drop the packets, reset the connection, or block the source in real time before the attack reaches its target. The placement difference creates an asymmetric risk profile: the IDS's out-of-band position means failures and false positives have no operational impact, but it cannot stop attacks in progress. The IPS's inline position enables active defense but makes false positives operationally damaging (legitimate traffic is blocked) and introduces a potential single point of failure — if the IPS goes down or becomes a bottleneck, it can disrupt the entire network.

This tradeoff explains why organizations often deploy IDS first, tune the detection rules, and only switch to IPS blocking mode after validating that the false positive rate is acceptably low. The inline position converts detection errors into disruptions, so operational risk must be managed before enabling blocking.