Advantage of IDS over IPS Deployment

The question asks for an advantage of using an Intrusion Detection System (IDS) over an Intrusion Prevention System (IPS). The key distinction lies in their placement and operational mode: IDS is passive (out-of-band), while IPS is active (in-line).

B. An IDS is less disruptive during the initial deployment of the technology. This is correct because an IDS can be deployed by tapping into a network segment or SPAN port without altering the physical path of traffic. In contrast, an IPS must be placed inline, requiring changes to cabling and potentially causing downtime during installation. For organizations prioritizing stability, the non-intrusive nature of IDS is a significant advantage.

A. An IDS requires less processing power to analyze traffic. Incorrect. Both systems perform deep packet inspection and signature matching. While an IPS might drop packets early, the analysis burden on the CPU is comparable; modern appliances handle both efficiently regardless of placement.

C. An IDS is easier to restrict access. Incorrect. Access restriction is a function of firewalls and ACLs. Neither IDS nor IPS inherently manages user access policies more easily than the other.

D. An IDS is more accurate due to fewer false positives. Incorrect. False positive rates depend on the quality of signatures and tuning, not the deployment mode. An IDS may actually suffer from higher false positives if it lacks context that an inline IPS might infer from blocking actions.