ISC2 CC Network Security Practice Question
A security analyst is deploying network security devices. Which TWO of the following are characteristics of an Intrusion Detection System (IDS)?
⚠ Common exam trap
The trap here is conflating IDS with IPS — candidates see 'block malicious traffic' and assume detection implies prevention, but the CC exam specifically tests that IDS is passive/alerting while IPS is inline/blocking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Operates in passive mode by monitoring a copy of traffic
Option B is correct because an IDS is fundamentally a passive monitoring technology: it receives a copy of the traffic (typically via a SPAN/mirror port or a network TAP) and analyzes it without sitting in the forwarding path, so it cannot drop packets. Option E is correct because the core function of an IDS is to detect suspicious or malicious activity and generate alerts (e.g., via signatures or anomaly detection) for analysts to investigate. Option A is wrong because inline blocking is characteristic of an IPS, not an IDS. Option C is wrong because an IDS does not automatically modify firewall rules; that would require integration with a firewall or an IPS/automated response system. Option D is wrong because no detection system guarantees zero false positives; IDS products inherently produce some false positives and false negatives.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Can be placed inline to block malicious traffic
Why it's wrong here
Inline placement with blocking capability describes an intrusion prevention system (IPS), not an IDS. It is tempting because vendors sell combined IDS/IPS appliances, but the detection-only characteristic means passive monitoring via a SPAN port or network TAP, not inline traffic interception.
- ✓
Operates in passive mode by monitoring a copy of traffic
Why this is correct
An IDS receives mirrored traffic via a SPAN port or TAP and analyses it without sitting inline, so it cannot block packets. This passive monitoring is the defining architectural characteristic distinguishing it from an IPS.
- ✗
Can automatically reconfigure firewall rules
Why it's wrong here
An IDS detects and alerts; it does not enforce changes to firewall rules, which requires an IPS or firewall management integration. It is tempting because many IDS platforms can trigger automated responses, but that capability belongs to intrusion prevention or SOAR orchestration, not detection itself.
- ✗
Ensures zero false positives
Why it's wrong here
No detection technology guarantees zero false positives; signature and anomaly engines inevitably produce them. It is tempting because tuning aims to reduce noise, and in a tightly baselined environment false positives can approach zero, but that is an operational outcome, not an inherent IDS characteristic.
- ✓
Generates alerts when suspicious activity is detected
Why this is correct
An IDS passively monitors network traffic and generates alerts upon detecting suspicious activity, satisfying the stem's requirement for a detection characteristic. Unlike an IPS, which sits inline and blocks traffic, an IDS does not intervene; it only notifies, which is precisely the behaviour this option describes.
Go deeper
Related to this question
Learn chapter
Incident Response and Management
Key term
Intrusion Detection System
An Intrusion Detection System (IDS) is a security tool that monitors network traffic or system activities for malicious actions or policy violations and sends alerts to administrators.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.