Comparison Table
| Option | Primary difference | Best use |
|---|---|---|
| IDS | Detects and alerts | Out-of-band or passive monitoring |
| IPS | Can block inline | Preventing known malicious traffic |
Exam clue: If prevention is required, a passive IDS alone is not enough.
How To Use It
Read the scenario for the required outcome. If the requirement is prevention, do not stop at detection. If the requirement is accountability, do not stop at authentication. If the requirement is recovery, distinguish data loss from service downtime.