Question about IDS and IPS

Question

I am studying Security Fundamentals on Networks and as a part of an excercise I have the following question:

Which of the following statements are true? (Select all that apply)

a.- An IDS deals with malicious traffic that the firewall missed.

b.- An IPS is on the boundary of the trusted inside and the untrusted outside.

c.- A network-based firewall protects hosts from malicious traffic originating on their same network.

d.- An IPS protects hosts from malicious traffic originating on their same network.

What could be the answers? According to me, b and c would be the answers because an IPS protects the original traffic that pass through, b because it is in the boundary but I have a doubt with option a because and IDS as I know makes a copy of the traffic just to analyze it.

Answer 1

First of all, let's look at definitions for IPS and IDS:

IDS:

An intrusion detection system (IDS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any detected activity or violation is typically reported either to an administrator or collected centrally using a security information and event management (SIEM) system.

IPS

Intrusion prevention systems (IPS) [...] are network security appliances that monitor network or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, report it and attempt to block or stop it.

Intrusion prevention systems are considered extensions of intrusion detection systems because they both monitor network traffic and/or system activities for malicious activity. The main differences are, unlike [IDS], [IPS] are placed in-line and are able to actively prevent or block intrusions that are detected. IPS can take such actions as sending an alarm, dropping detected malicious packets, resetting a connection or blocking traffic from the offending IP address.

(Emphasis mine.)

Now let's look at the question and the given answers:

Which of the following statements are true? (Select all that apply)

a.- An IDS deals with malicious traffic that the firewall missed.

As we just learned, an IDS is only used for monitoring and not for "dealing with" (whatever that means exactly). It is fair to say that IDS is not actively involved in blocking or filtering such traffic, so "dealing with" is probably: FALSE.

As Georgios pointed out, "dealing with" could also be interpreted less actively, so this might be TRUE. English is not my first language, so other comments are welcome.

b.- An IPS is on the boundary of the trusted inside and the untrusted outside.

I wouldn't say so, but you could argue it that way. Typically the IPS sits behind the boundary - this is where the firewall would be - to lower the load of traffic the IPS has to analyze. The firewall filters out most of the easy-to-detect unwanted traffic, the IPS takes care of the more sophisticated stuff.

In my view: FALSE.

c.- A network-based firewall protects hosts from malicious traffic originating on their same network.

Nope. A network-based firewall protects hosts inside a network from malicious traffic that originates from the internet or any other network that sends traffic to these hosts. A host-based firewall protects a host (if set up correctly) from all sorts of traffic, irrelevant where it comes from. This would be a software that is installed on a machine, like Windows firewall.

FALSE.

d.- An IPS protects hosts from malicious traffic originating on their same network.

Helloooo, there it is. This is a correct statement. BUT, an IPS does more than that. See (at least) wikipedia article for more information on that.

TRUE.

Answer 2

I would say
A False, as IDS only notifies and does not prevent intrusion. So the missed traffic will pass.
B TRUE
C False as network-based firewall will inspect all packets that are originating from both the local and outside networks. (in case they pass the firewall)
D False, the same as C.

Answer 3

The correct answer should be A and D option.

a.- An IDS deals with malicious traffic that the firewall missed.

b.- An IPS is on the boundary of the trusted inside and the untrusted outside.

c.- A network-based firewall protects hosts from malicious traffic originating on their same network.

d.- An IPS protects hosts from malicious traffic originating on their same network.

Answer 4

Remember the difference between IDS and IPS. Detection and Prevention. Wjile IDS may run on a host and can detect attacks it has no way to prevent them. Since a IPS is on the firewall it can see and stop all malicious traffic.

A, True, since it may be implemented on the hosts (HIDS)

B, True, an IPS must be able to stop malicious traffic

C, False, a firewall is not inspecting packets on the same network

D, False, for the same reason as B

Answer 5

My Answer is:

A - True - traffic that evades the firewalls will be deal with IDS and IPS.

B - False- A Firewall sits on the border between the trusted inside and the untrusted outside.

C - True - A network vulnerable to malicious traffic originating from that very network.

D - True - IPS as a control device is in-line, so original traffic must pass through the IPS.