thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Operations

IDS vs IPS: What's the Difference?

An IDS monitors a copy of traffic and alerts on suspicious activity but does not block it. An IPS sits inline in the traffic path and can actively drop or block malicious packets in real time.

Intrusion Detection System (IDS)

Full definition
vs

Intrusion Prevention System (IPS)

Full definition
Intrusion Detection SystemIntrusion Prevention System
PlacementOut-of-band (SPAN port or tap)Inline
ActionDetect and alertDetect and block
Control typeDetectivePreventive
Effect of false positiveAn unnecessary alertLegitimate traffic gets blocked
Failure impactNo effect on traffic flowCan drop traffic if it fails closed
LatencyNone addedSlight added latency
Detection methodsSignature, anomaly, heuristicSignature, anomaly, heuristic
Remember it

IDS is a smoke alarm; IPS is a sprinkler.

Exam tip

Questions mentioning a SPAN port or passive monitoring want IDS. If the scenario requires automatically stopping an attack, choose IPS, and be ready to discuss fail-open versus fail-closed.

Tested on

More Security Operations look-alikes