What are the key differences between IDS and IPS and their typical detection approaches?

• A. IDS detects and alerts on suspicious activity; IPS can also block or drop traffic; detections include signature-based and anomaly-based methods
• B. IPS detects and alerts on suspicious activity; IDS can also block or drop traffic.
• C. IDS automatically neutralizes threats.
• D. Detection uses only reputation-based.

Answer: (A)

Differentiating action and placement: an IDS monitors network traffic and raises alerts when it detects something suspicious, while an IPS sits in-line and can actively block or drop traffic to prevent threats from reaching systems. For detection approaches, both typically use signature-based methods (looking for known attack patterns) and anomaly-based methods (spotting deviations from normal behavior). The described statement matches this distinction and these common methods, making it the best fit. While reputation signals exist, they’re not the sole or definitive detection approach, and other options describe incorrect roles or capabilities.