What is the primary purpose of an intrusion detection system?

• A. Gather and analyze information to identify security policy violations
• B. Deploy network filters
• C. Create backups
• D. Manage user accounts

Answer: (A)

An intrusion detection system is designed to monitor, collect, and analyze data from your network and host systems to spot activities that violate security policies or indicate an attack. It continuously watches network traffic, logs, and security events, using rules, signatures, or anomaly-detection models to identify patterns that match known exploits or unusual, potentially malicious behavior. When something suspicious is found, it generates alerts so security personnel can investigate and respond. This focus on detection and alerting is what makes it the best fit for the primary purpose. It isn’t primarily about deploying filters (that’s typically the role of a firewall or intrusion prevention system), nor is it about creating backups or managing user accounts.