(ISC)2 Certified in Cybersecurity Practice Exam

What system is designed to monitor network traffic for signs of malicious activity?

1. IDS

2. Firewall

3. Anti-Virus

4. Cameras

The correct answer is: IDS

An Intrusion Detection System (IDS) is specifically designed to monitor network traffic and detect signs of malicious activity or policy violations. It analyzes the patterns of incoming and outgoing data packets and compares them against known signatures of attacks, as well as flagging anomalous behavior that may indicate potential threats. The primary function of an IDS is to identify intrusions and alert system administrators or security personnel so they can take appropriate action. It can operate in two modes: passive, where it monitors and alerts, and active, where it can take preliminary action to prevent detected intrusions. In contrast, a firewall acts as a barrier between a trusted internal network and untrusted external networks, controlling incoming and outgoing traffic based on predetermined security rules, but it doesn't analyze traffic for detailed malicious behavior in the same way an IDS does. Anti-virus software focuses on detecting and eliminating malware on individual devices rather than monitoring network traffic as a whole, ensuring endpoint security rather than network-wide surveillance. Finally, cameras are generally used for physical security to monitor the premises rather than for monitoring network traffic or malicious activity. Therefore, the IDS stands out as the most appropriate system for the task described in the question.