An IDS that compares observed events against defined activities for each protocol is a
A) Firewall
B) Signature-based IDS
C) Anomaly-based IDS
D) Protocol-state IDS

Question

Quizplus · Accepted Answer

A protocol-state IDS specifically compares observed events against defined activities for each protocol. Firewall and signature-based IDS do not have this specific capability. Anomaly-based IDS may detect deviations from normal behavior, but it does not necessarily rely on predefined activities for each protocol.

An IDS That Compares Observed Events Against Defined Activities for Each