How do you stop an attacker who is already inside your network? Firewalls block the front door, but they cannot catch a threat that has already slipped through. For the 200-201 exam, you need to understand how IDS and IPS systems work as a second line of defence — this chapter breaks down the differences between them and shows how firewall technologies fit into the bigger picture.
Jump to a section
A simple way to picture IDS, IPS, and Firewall Technologies
When you arrive at an airport, the first thing you encounter is the main security checkpoint — this is your firewall. It checks every passenger and bag against a set of rules: only ticket holders with valid ID can pass, and certain items like liquids over 100ml are banned. If you match the rules, you get through. If not, you're stopped.
Once you're in the secure departure lounge, there are two more layers of protection. The first is an IDS — a security camera system monitored by a guard in a back room. The guard watches the live feeds and spots suspicious behaviour (someone leaving a bag unattended, someone climbing over a barrier), but the guard cannot stop the person. They just log what happened and alert airport police. They detect the threat but take no action.
The second layer is an IPS — a magnetometer that also makes an alarm, but if it detects a prohibited item, it automatically locks the person inside a holding cell. The IPS sits inline, so it can actively block the threat before it becomes real. The guard at the camera is an IDS. The automated lock-down door is an IPS. The checkpoint at the entrance is the firewall. All three work together to keep the airport safe, but each does a completely different job.
If you are studying for the CyberOps Associate 200-201 exam, you will see three security technologies mentioned over and over: firewall, IDS, and IPS. They sound similar, but they do fundamentally different things. Understanding the difference is critical to the exam and to any real-world security job.
Let's start with a firewall. Think of a firewall as a security guard at the main entrance of a building. The guard checks each person who tries to come in or go out. If the person matches the allowed list — for example, an employee badge — the guard lets them through. If the person does not match, the guard stops them. A firewall behaves the same way with network traffic. It inspects packets (small chunks of data sent across a network) and decides whether to allow or block them based on predefined rules. Those rules might allow web traffic on port 80 or 443, but block remote desktop traffic on port 3389. Firewalls operate at the network perimeter, meaning they sit between your internal network and the internet. They are the first line of defence. But here is the problem: if an attacker tricks the firewall — for example by using a trusted port — they can get inside. Once inside, the firewall cannot see them. That is where IDS and IPS come in.
An IDS (Intrusion Detection System) is like a security camera that watches what happens inside the building after people have entered. The IDS sits off to the side, out of the main traffic flow (known as out-of-band). It copies network traffic and analyses it for signs of suspicious activity. If it sees something unusual — a pattern that matches a known attack, like a buffer overflow or a SQL injection — it generates an alert. The IDS sends the alert to a security analyst, but it does not stop the traffic. It cannot, because it is not in the path of the traffic. The traffic continues flowing while the analyst decides what to do. This is both a strength and a weakness. The strength is that the IDS does not slow down the network. The weakness is that the attack can succeed before the analyst acts.
An IPS (Intrusion Prevention System) is the opposite. It sits directly in the traffic path (known as in-band). Think of an IPS as a magnetometer at the gate inside the building — it checks every person before they can move further. If the IPS detects a threat, it drops the packet immediately. It can block the traffic, reset the connection, or even reconfigure the firewall to block the attacker entirely. The IPS acts in real time without waiting for a human. The downside is that if the IPS makes a mistake (false positive), it can block legitimate traffic and cause problems for users.
Modern vendors often sell a combined appliance called a next-generation firewall (NGFW) that includes firewall, IDS, and IPS capabilities in one box. But you need to know the exam treats them as separate concepts. Firewalls make allow/deny decisions based on port, protocol, and IP address. IDS detects threats and alerts. IPS detects and blocks threats.
Both IDS and IPS use signatures to identify attacks. A signature is a pattern that matches a known threat — like a specific string of characters in a network packet that is known to be part of a malware download. They can also use anomaly-based detection, which compares current traffic against a baseline of normal behaviour. If traffic deviates from the baseline — for example, a sudden spike in data leaving the network — the system raises an alert.
For the exam, you must also understand the concept of management vs. monitoring. The management interface is used by administrators to configure the device and update signatures. The monitoring interface is what actually watches the traffic. Never confuse the two — the exam loves that trap.
Finally, remember that both IDS and IPS come in two forms: network-based (NIDS/NIPS) which monitors traffic for all devices on the network, and host-based (HIDS/HIPS) which runs as software on a single computer or server. The exam will ask you to distinguish between these types.
Packet Arrives at the Network
A packet of data arrives at the perimeter of the network. This could be a legitimate web request from a user or an attacker's attempt to exploit a vulnerability. The first device it meets is the firewall.
Firewall Makes Initial Allow/Deny Decision
The firewall checks the packet's source IP, destination IP, port number, and protocol against its rule base. If the packet matches a 'permit' rule (like HTTP traffic on port 80), it is allowed in. If it matches a 'deny' rule, it is dropped. This step is stateful, meaning the firewall tracks the connection state so return traffic is automatically allowed.
Packet Reaches the IPS (In-Line Deployments)
If the packet passes the firewall and an IPS is deployed in-line, the IPS inspects the packet's payload — the actual data content. It compares the payload against thousands of signatures. If a signature matches an attack pattern (e.g., a SQL injection string like ' OR 1=1 --), the IPS takes action.
IPS Decides on Action
The IPS can drop the packet, reset the TCP connection (by sending a RST flag to both ends), block the source IP for a configurable time, or simply log the event if configured in monitor-only mode. These actions happen in milliseconds without human intervention.
IDS Receives a Copy (Out-of-Band Deployments)
If an IDS is used instead of an IPS, the switch sends a copy of the packet to the IDS via a SPAN port. The IDS analyses the copy. If it detects a threat, it logs the event and sends an alert (e.g., email, syslog, or SNMP trap) to the security analyst. The original packet continues to its destination uninterrupted.
Analyst Reviews the Alert (IDS Scenario Only)
The security analyst checks the IDS alert, reviews the packet capture, and determines whether the alert is a true positive (real attack), a false positive (benign traffic flagged incorrectly), or a false negative (missed attack). Based on the finding, the analyst may manually block the attacker IP, update signatures, or modify firewall rules.
Let's walk through a realistic scenario. You are the only security analyst at a medium-sized e-commerce company with 200 employees. Your company processes credit card payments through a web application. Your manager says: 'We have a firewall, I set it up myself last year. Are we secure?'
The answer is no. A firewall alone cannot protect you from threats that enter through allowed traffic. Here is what happens next.
You start by deploying a network-based IDS (NIDS) on the core switch. You configure it out-of-band by connecting a dedicated monitoring port (SPAN port) to your IDS appliance. The IDS copies all traffic passing through the switch. You download the latest signature set from the vendor — these are pre-built patterns for known attacks like SQL injection attempts, Cross-Site Scripting (XSS), and known malware command-and-control traffic.
Day one after deployment: The IDS sends you an alert at 2:00 AM. It shows a TCP connection from an internal IP (a workstation in accounting) to an external IP in a country known for cyber crime. The alert severity is 'high' because the destination IP is on a threat intelligence blacklist. But the IDS did not stop the connection — it just logged it. You wake up, check the logs, and see that the workstation has been sending small packets every hour for three days. This is likely an active data exfiltration (stealing data). You call the accounting manager and confirm the employee is not running any authorised backup. You then block the destination IP at the firewall manually and quarantine the workstation. The IDS caught the threat, but it took three hours for you to act because it was 2 AM and you were asleep.
After that incident, your manager approves the purchase of an IPS. You deploy it in-line between the internet router and the firewall. Now the IPS sees every packet before it reaches the firewall. You configure it to automatically drop any traffic matching known command-and-control signatures. Two weeks later, another workstation attempts to connect to the same malicious IP. The IPS drops the packet within milliseconds and sends you a post-event alert. The threat is blocked instantly — no data leaves, no middle-of-the-night wake-up call.
Your real-world tasks will include:
Selecting the right deployment mode (out-of-band for IDS or in-line for IPS)
Tuning signatures to reduce false positives — if the IPS blocks too many legitimate requests, the sales team will complain they cannot access their CRM
Scheduling signature updates weekly or daily
Reviewing IDS/IPS logs after a security incident to understand what happened
Testing in 'monitor-only' mode for new signatures before enabling them in 'block' mode
Segmenting the network so the IPS does not become a single point of failure
An IT professional must also know that IPS placement is critical. Put it at the internet edge for external threats, and put a separate IPS on internal network segments (like between the HR network and the sales network) to catch lateral movement — attackers who have already breached one part of the network and are trying to move sideways.
The 200-201 exam tests objective 5.2 with a heavy emphasis on comparing and contrasting IDS, IPS, and firewall technologies. You will see multiple-choice questions that require you to pick the correct description for each technology or to choose the correct action for a given scenario. Here is what you need to know to pass these questions.
First, the exam loves to test the fundamental difference between detection and prevention. A question might say: 'An administrator sees an alert about suspicious traffic but the traffic was not blocked. Which technology is most likely in use?' The answer is IDS, because IDS detects but does not block. The trap is that some students choose 'firewall' because they think all security devices block. Firewalls block based on rules, but they do not detect unknown attacks. IDS detects but does not block. IPS blocks and detects. Memorise this triangle.
Second, the exam tests deployment modes. You must know that IDS is out-of-band (meaning it receives a copy of traffic, not the original) and IPS is in-line (meaning traffic actually flows through it). They will ask you which device can fail closed (meaning if the IPS fails, traffic stops) versus fail open (if IDS fails, traffic continues). The correct answer is IPS can fail closed, IDS fails open because it is not in the traffic path.
Third, expect questions about signature vs. anomaly-based detection. Common traps include confusing 'heuristic' (which is a synonym for anomaly-based) with 'signature'. Remember: signatures match known patterns; anomaly-based detection looks for deviations from a baseline.
Key exam topics to memorise:
Firewall: Stateful vs. stateless. Stateful firewalls track the state of active connections and allow return traffic automatically. Stateless firewalls check each packet individually without context. The exam expects you to know that modern firewalls are stateful.
NIDS vs. HIDS: NIDS monitors network traffic for all devices. HIDS monitors a single host's logs, file integrity, and system calls.
False positive vs. false negative: False positive = the system flagged something benign as a threat. False negative = the system missed a real attack. The exam will test which is worse — typically false negatives are worse because an attack gets through.
Signature updates: IDS/IPS need up-to-date signatures to catch new threats. The exam may ask about the difference between a 'signature' and a 'policy'.
IPS actions: Besides dropping a packet, an IPS can also reset the TCP connection (send a RST packet), block the source IP for a period, or reconfigure the firewall.
Evasion techniques: Attackers can split packets or encrypt traffic to bypass IDS/IPS. The exam may ask how to counter this — answer: use reassembly and TLS inspection.
Finally, the exam will sometimes give you a scenario with a diagram showing a network topology. They will ask which device should be placed where. For example: 'Where would you place an IPS to protect the internal network from internet threats?' Answer: between the router and the firewall, or between the firewall and the internal switch. Always choose the in-line position for IPS.
Common traps:
Thinking IDS can block traffic (it cannot)
Confusing the management interface with the monitoring interface
Thinking a firewall does the same job as an IPS (firewall does not inspect packet payloads deeply for attack signatures)
Assuming all IDS/IPS are network-based (remember host-based versions exist)
Forgetting that an IPS can cause network outages if it fails or if a false positive blocks legitimate traffic
A firewall makes allow/deny decisions based on IP addresses, ports, and protocols, but it does not inspect packet payloads for malicious content.
An IDS (Intrusion Detection System) monitors network traffic out-of-band and generates alerts but cannot block traffic.
An IPS (Intrusion Prevention System) sits in-line and can automatically drop malicious packets or reset connections in real time.
IDS/IPS use signature-based detection (matching known attack patterns) and anomaly-based detection (comparing traffic to a baseline of normal behaviour).
False positives occur when the system flags legitimate traffic as a threat; false negatives occur when a real attack is missed.
Host-based IDS/IPS (HIDS/HIPS) run on individual devices, while network-based IDS/IPS (NIDS/NIPS) monitor traffic for an entire network segment.
An IPS can fail closed (blocking all traffic if it breaks), while an IDS fails open (traffic continues because it is not in the path).
These come up on the exam all the time. Here's how to tell them apart.
IDS (Intrusion Detection System)
Operates out-of-band (receives copy of traffic)
Cannot block traffic; only alerts
Fails open (traffic continues if device fails)
IPS (Intrusion Prevention System)
Operates in-line (traffic flows through it)
Can block or modify traffic automatically
Can fail closed (traffic stops if device fails)
Signature-Based Detection
Matches traffic against known attack patterns (signatures)
Very low false positive rate for known attacks
Cannot detect unknown (zero-day) attacks
Anomaly-Based Detection
Compares traffic against a baseline of normal behaviour
Can detect unknown attacks
Higher false positive rate because normal variations may be flagged
NIDS (Network-based IDS)
Monitors traffic on a network segment for all devices
Cannot see encrypted traffic without TLS inspection
Deployed on a dedicated appliance or virtual machine
HIDS (Host-based IDS)
Runs as software on a single host (server or workstation)
Can monitor host system logs, file changes, and local processes
Cannot see traffic on other hosts on the network
Stateful Firewall
Tracks the state of active connections (e.g., TCP handshake)
Automatically allows return traffic for established connections
Modern standard for network firewalls
Stateless Firewall
Examines each packet independently without context
Requires explicit rules for both directions
Older technology, rarely used alone today
Mistake
A firewall and an IPS are the same thing because they both block traffic.
Correct
A firewall makes allow/deny decisions based on port, protocol, and IP address. An IPS inspects the actual content of the packet for attack signatures and can block threats that a firewall would allow through because they use a legitimate port like port 80.
Students often assume any device that blocks traffic is a firewall. The exam tests the deep packet inspection capability of IPS, which firewalls do not traditionally perform.
Mistake
An IDS can block an attack automatically without human intervention.
Correct
An IDS generates an alert but does not sit in the traffic path, so it cannot block anything. Only an IPS (which is in-line) can automatically block traffic.
The names sound similar — 'detection' and 'prevention' — and beginners think detection implies action. But detection is passive, prevention is active.
Mistake
If you have an IPS, you do not need a firewall.
Correct
Firewalls and IPS perform different functions. A firewall controls access and segments the network. An IPS inspects traffic for attacks. They complement each other; you need both for defence in depth.
Vendors often sell combined NGFW appliances, which leads beginners to think one replaces the other. But the exam treats them as distinct layers.
Mistake
An IDS should be placed in-line so it can see all traffic.
Correct
An IDS must be placed out-of-band (connected to a SPAN port or network tap) because it only needs a copy of the traffic. Placing it in-line would introduce a single point of failure and slow down the network.
It seems intuitive that seeing all traffic means being in the path. But IDS is designed to monitor passively, not to intercept.
Mistake
Signature-based detection is always more effective than anomaly-based detection.
Correct
Signature-based detection is excellent for known attacks but cannot detect zero-day attacks (brand new threats with no signature). Anomaly-based detection can detect unknown threats but has a higher false positive rate. Both are used together in modern systems.
Students assume that because signatures are concrete and specific, they are always better. But the exam tests the trade-off between known and unknown threats.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
IDS is like a security camera that watches and sends you an alert when something suspicious happens, but it cannot stop the person. IPS is like an automatic door lock that stops the person immediately without waiting for you.
No. A firewall controls access based on IP and port rules, while an IPS inspects the content of traffic for attacks. They serve different purposes and work best together in a defence-in-depth strategy.
In-line means the device sits directly in the path the traffic travels. All incoming and outgoing packets must pass through the IPS. This allows the IPS to block or modify traffic in real time.
A false positive occurs when the system flags normal, legitimate traffic as an attack. For example, an IPS might block a user's legitimate database query because it contains a word that matches a SQL injection signature.
HIDS stands for Host-based Intrusion Detection System. It runs on a single computer and monitors system logs, file integrity, and local network traffic to that host. NIDS monitors all traffic on an entire network segment.
The 200-201 exam expects you to understand the configuration differences conceptually — you will not configure an actual device. Know that IDS is out-of-band, IPS is in-line, and each requires signature tuning and regular updates.
You've finished IDS, IPS, and Firewall Technologies. Continue through the 200-201 study guide to build a complete picture of the exam.
Done with this chapter?