Which IDS type monitors network traffic across the network rather than focusing on a single host?

Which IDS type monitors network traffic across the network rather than focusing on a single host?

• A. Network-based IDS (NIDS)
• B. Host-based IDS
• C. Signature-based IDS
• D. Anomaly-based IDS

Answer: (A)

Monitoring traffic across the network is the job of a network-based IDS. It sits at multiple points in the infrastructure or at the network perimeter and watches the data flowing between hosts, allowing it to detect suspicious activity that involves more than one machine. A host-based IDS, in contrast, runs on a single machine and analyzes that machine’s local events, logs, and system calls, not the broader traffic. The terms signature-based and anomaly-based describe how detections are made (matching known patterns or flagging deviations), and these methods can be used by either network- or host-based sensors. But they don’t define the scope of what is being monitored. So the option that best fits the description of network-wide traffic monitoring is the network-based IDS.

Monitoring traffic across the network is the job of a network-based IDS. It sits at multiple points in the infrastructure or at the network perimeter and watches the data flowing between hosts, allowing it to detect suspicious activity that involves more than one machine. A host-based IDS, in contrast, runs on a single machine and analyzes that machine’s local events, logs, and system calls, not the broader traffic. The terms signature-based and anomaly-based describe how detections are made (matching known patterns or flagging deviations), and these methods can be used by either network- or host-based sensors. But they don’t define the scope of what is being monitored. So the option that best fits the description of network-wide traffic monitoring is the network-based IDS.