Which of the following are uses for IDS and IDPS?

• A. Identify Possible Incidents; Identify Reconnaissance Activity; Identifying Security Policy Problems
• B. Documenting Existing Threat to an org
• C. Deterring individuals from violating security policies
• D. All of the above

Answer: (D)

IDS/IDPS are built to monitor networks or hosts for signs of unauthorized or suspicious activity and to alert administrators; IDPS extends that by taking automated actions to block or mitigate threats. Because of this, their uses include identifying possible incidents, spotting reconnaissance activity such as probing or scanning, and surfacing security policy problems when patterns indicate misconfigurations or violations. The logs and alerts they produce also help document the current threats facing the organization and support incident response planning. The capability to alert, log, and sometimes block also contributes to deterrence, since potential attackers know they may be detected and prevented. Since all of these are valid uses, the best answer is that all of the above applies.