What is the primary function of an Intrusion Detection System (IDS)?

• A. It prevents intrusions by itself.
• B. It logs all user activity for compliance only.
• C. It monitors network traffic to detect signs of malicious activity and policy violations.
• D. It encrypts data in transit.

Answer: (C)

Intrusion Detection System focuses on monitoring network traffic and system activities to detect signs of malicious behavior or policy violations. It continuously analyzes packets and events, using signature-based checks for known attacks and anomaly-based checks to spot unusual activity. When a potential threat is detected, it raises alerts and logs details for the security team to investigate. It's a detection tool, not a blocker—unlike an Intrusion Prevention System or firewall, which can automatically block traffic. Encrypting data and logging for compliance are separate functions and not the IDS’s primary role.