SSCP Risk Identification, Monitoring, and Analysis Practice Question
Which type of IDS monitors network traffic at a specific network segment and analyzes packets for malicious patterns?
⚠ Common exam trap
In the SSCP exam, the distinction between network-based and host-based monitoring is important, and the trap here is that candidates confuse HIDS with NIDS because both involve 'intrusion detection,' but HIDS operates on the host while NIDS operates on the network segment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NIDS
A Network Intrusion Detection System (NIDS) is specifically designed to monitor traffic on a network segment, capturing packets in real time and analyzing them for known attack signatures or anomalous patterns. Unlike host-based systems, NIDS operates at the network layer, inspecting headers and payloads to detect malicious activity such as port scans, DoS attacks, or exploit attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NIDS
Why this is correct
A Network IDS (NIDS) passively inspects packets traversing a network segment, matching them against signatures to identify malicious patterns. This placement and packet-analysis capability is exactly what the stem describes, distinguishing it from host-based monitoring.
- ✗
HIDS
Why it's wrong here
A HIDS runs on an individual host, inspecting that host's logs, file integrity and system calls; it never sees packets traversing a network segment. It is tempting because host-level monitoring is genuinely needed, but the stem specifies segment-level packet analysis, which is network-based IDS territory.
- ✗
UBA
Why it's wrong here
UBA baselines user and entity behaviour to flag anomalous activity from logs and events; it performs no packet capture or signature inspection at a network segment. UBA fits detecting compromised credentials or insider drift, not the packet-analysis role the stem describes.
- ✗
SIEM
Why it's wrong here
A SIEM aggregates and correlates logs from many sources for alerting and forensics; it does not itself capture and inspect packets on a network segment. SIEM is the right choice when centralising log correlation across an estate, but the stem asks for the sensor performing packet-level analysis.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.