Palo Alto Networks (PANW) Certified Cybersecurity Entry-level Technician (PCCET) Practice Exam

Which type of security measure does an intrusion detection system provide?

1. Preventive

2. Detective

3. Corrective

4. Auditive

The correct answer is: Detective

An intrusion detection system (IDS) primarily serves as a detective control within cybersecurity frameworks. Its main function is to monitor network traffic and system activities for suspicious behavior that may indicate a security breach, such as unauthorized access attempts or anomalies that deviate from normal patterns. When the IDS identifies potential threats, it alerts administrators so they can take appropriate actions to address the vulnerabilities or incidents. This characteristic of identifying and reporting threats categorizes IDS as a detective mechanism. Unlike preventive measures that are designed to block threats before they occur, or corrective measures that are aimed at recovering from a security breach, an IDS does not actively prevent attacks but rather detects and informs about them. Auditive is not a recognized category in security measures related to intrusion detection. By focusing on detection, an IDS plays a critical role in an organization's ability to respond to threats and enhance overall security posture. This is why it is correct to identify the type of measure that an intrusion detection system provides as detective.