Which system monitors all network traffic, ideal for observing sensitive network segments?

Which system monitors all network traffic, ideal for observing sensitive network segments?

• A. Network-based Intrusion Detection System (NIDS)
• B. Host-based Intrusion Detection System (HIDS)
• C. Network Intrusion Prevention System (NIPS)
• D. Security Information and Event Management (SIEM)

Answer: (A)

The main idea is network-wide visibility: you want a system that can see all the traffic flowing through a network segment to observe what’s happening where it matters. A network-based Intrusion Detection System is placed at strategic points on the network (such as a tap or mirror port) to observe all packets that traverse that segment. It analyzes the traffic in real time for known attack patterns and anomalous behavior and raises alerts when something suspicious is detected, providing broad visibility across sensitive networks without having to install software on every device. This contrasts with a host-based IDS, which only monitors activity on a single machine; a network intrusion prevention system, while it can block traffic inline, focuses on preventing threats and is not solely about observing traffic; and a SIEM, which collects and correlates logs from many sources rather than providing comprehensive live traffic monitoring of a segment.

The main idea is network-wide visibility: you want a system that can see all the traffic flowing through a network segment to observe what’s happening where it matters. A network-based Intrusion Detection System is placed at strategic points on the network (such as a tap or mirror port) to observe all packets that traverse that segment. It analyzes the traffic in real time for known attack patterns and anomalous behavior and raises alerts when something suspicious is detected, providing broad visibility across sensitive networks without having to install software on every device. This contrasts with a host-based IDS, which only monitors activity on a single machine; a network intrusion prevention system, while it can block traffic inline, focuses on preventing threats and is not solely about observing traffic; and a SIEM, which collects and correlates logs from many sources rather than providing comprehensive live traffic monitoring of a segment.