Best IDS Type for Intrusion Detection - CompTIA Security+ SY0-601

A.

The type of IDS (Intrusion Detection System) that detects possible intrusions based on a vendor provided list is known as a signature-based IDS.

A signature-based IDS works by analyzing network traffic, looking for specific patterns or signatures that match a known attack or intrusion. These signatures are typically created by security vendors, who analyze known attacks and develop rules to identify them.

When network traffic matches a signature, the IDS will generate an alert, indicating that a potential intrusion has been detected. The security administrator can then investigate the alert to determine if further action is required.

One advantage of signature-based IDS is that it can quickly detect known attacks, as long as the IDS has a matching signature. However, it can be less effective against new or unknown attacks, which may not have a matching signature.

In contrast, a heuristic-based IDS attempts to detect attacks based on general characteristics of the traffic, such as the rate or volume of traffic, rather than specific signatures. Anomaly-based IDS look for unusual patterns in network traffic, while behavior-based IDS monitor user behavior for suspicious activity.

Overall, the use of multiple types of IDS, including signature-based, heuristic, anomaly-based, and behavior-based, can provide a more comprehensive approach to intrusion detection and prevention.