Exam CISA topic 1 question 913 discussion

D. Does not detect attacks originating on the server hosting the IDS: This is a significant limitation. Network-based IDSs are designed to monitor traffic passing through the network. They do not have visibility into activities occurring directly on a server, such as a compromised server initiating attacks or malicious actions. For such detection, a host-based intrusion detection system would be required.Cmiiw

D is correct.

The GREATEST limitation of a network-based intrusion detection system (IDS) among the options provided is: C. consumes excessive network resources for detection Network-based IDS systems can indeed consume significant network resources, especially if they are deployed in a high-traffic network environment. This is because they need to inspect network traffic in real-time, which involves analyzing packets and looking for patterns or anomalies. In busy networks, this can lead to performance degradation and resource utilization concerns. It's essential to carefully plan and tune network-based IDS to minimize its impact on network performance.

Should be D. A network-based IDS is designed to monitor and analyze network traffic to identify potential security threats and attacks. However, it operates at the network perimeter and cannot detect attacks that originate from within the network it is supposed to protect, specifically from the server hosting the IDS itself.

D. does not detect attacks originating on the server hosting the IDS