NIDS and HIDS Quiz: Test Your Knowledge of Intrusion Detection

📚 Quick Study Guide: NIDS & HIDS Essentials

• 🌐 NIDS (Network Intrusion Detection System): Monitors network traffic on a segment or an entire network for suspicious activity. It analyzes packet headers and payloads.
• 💻 HIDS (Host Intrusion Detection System): Runs on individual hosts (servers, workstations) and monitors system files, log files, running processes, and application activity for malicious behavior.
• 🔍 Detection Methods: Both can use signature-based (known attack patterns) and anomaly-based (deviations from normal baseline) detection.
• 🚨 Alerting: When an intrusion is detected, both generate alerts (logs, emails, SNMP traps) to administrators.
• 🚫 Prevention vs. Detection: IDS *detects* intrusions; it doesn't *prevent* them. IPS (Intrusion Prevention System) takes action to block threats.
• 🔄 Placement: NIDS sensors are often placed at network choke points (e.g., perimeter, internal network segments). HIDS agents are installed directly on critical hosts.
• 📈 Benefits: NIDS offers broad network visibility; HIDS provides deep insight into host integrity and activity.

🧠 Practice Quiz: NIDS & HIDS

1. What is the primary function of a Network Intrusion Detection System (NIDS)?
   A. To encrypt all network traffic
   B. To block all incoming connections
   C. To monitor network traffic for suspicious activity
   D. To manage user authentication
   
2. Which of the following is a key characteristic of a Host Intrusion Detection System (HIDS)?
   A. It operates by analyzing traffic across an entire network segment.
   B. It is installed directly on a specific server or workstation.
   C. It primarily focuses on detecting physical breaches.
   D. It actively prevents all forms of malware from executing.
   
3. A NIDS typically monitors which type of data?
   A. Local user logins and file access attempts
   B. System call activity and registry changes
   C. Packet headers and network protocol usage
   D. Application-level memory allocations
   
4. What is a common method used by both NIDS and HIDS to identify known threats?
   A. Heuristic analysis
   B. Anomaly detection
   C. Signature-based detection
   D. Behavioral analysis
   
5. If an attacker modifies critical system files on a server, which type of IDS is most likely to detect this activity?
   A. NIDS
   B. Firewall
   C. HIDS
   D. Proxy Server
   
6. Which statement best describes the difference between an IDS and an IPS?
   A. IDS detects and blocks, while IPS only detects.
   B. IDS detects, while IPS detects and prevents.
   C. IDS is software, while IPS is always hardware.
   D. IDS is host-based, while IPS is network-based.
   
7. Where would you typically deploy a NIDS sensor for optimal network visibility?
   A. Only on individual user workstations.
   B. On a single, isolated server.
   C. At network choke points, like the perimeter or internal segment gateways.
   D. Inside every application container.