Which of the following describes typical IDS characteristics?

• A. Always running, not too resource rich, detects abnormal behavior, and adapts to system behavior
• B. Centralized management and heavy resource use
• C. Blocks traffic automatically
• D. Reports only after breach

Answer: (A)

Intrusion detection systems are built to monitor continuously and alert on suspicious activity, not to actively block it. A typical IDS is always running, watching network traffic and system events, so it can spot unusual patterns as soon as they appear. It’s designed to be mindful of resources—efficient enough that it doesn’t cripple the host or network while still catching potential problems. A key feature is adapting to how the environment behaves over time, using baselines and learning what normal looks like so that anomalies stand out more clearly.

Alerts are generated when something looks off, providing real-time or near-real-time information to investigators. This distinguishes an IDS from an intrusion prevention system, which can block traffic automatically. It’s also not strictly defined by centralized management or by consuming heavy resources; those aspects can occur in some setups but aren’t defining traits of IDS itself. An IDS won’t typically wait for a breach to be noticed; it aims to detect and report suspicious activity as it happens, so responses can begin sooner.