At 2:14 a.m. a sensor attached to a mirrored switch port logs that a workstation looked up a domain tied to a known malware family. Nothing blocked the lookup, and nothing was supposed to: the sensor's job was to notice and tell someone. In the data center, a second device sitting directly in the traffic path drops an exploit aimed at the mail server before it arrives. The detection engine is the same in both; the jobs are different.
On the CompTIA Security+ SY0-801 exam, intrusion detection and prevention sit under objective 4.1, which expects you to choose the right mitigating control for a scenario. This lesson covers network-based intrusion detection and prevention systems, where each is placed, how signature and anomaly detection differ, false positives and false negatives, how to read an alert, and wireless intrusion prevention.
An IDS watches and alerts, while an IPS sits in the path and blocks
An intrusion detection system (IDS) examines traffic, compares it with its detection logic and raises alerts for analysts or a SIEM. It is a detective control. A network IDS usually works from a copy of the traffic, so by the time it alerts, the packets have already been delivered.
An intrusion prevention system (IPS) uses the same kind of detection but sits inline, so every packet passes through it. When a rule fires, it can drop the packet, reset the connection, block the source address for a period, or simply alert for rules set to monitor only. That makes it a preventive control as well as a detective one.
A network-based system (NIDS or NIPS) watches traffic on a network segment. Host-based versions (HIDS and HIPS) run on a single system and watch its files, logs and processes; they are covered in the endpoint security lesson. Suricata and Snort are well-known open-source network engines, and most next-generation firewalls and UTM appliances include an IPS module.
On the exam, "alert", "notify" and "monitor" point to an IDS. "Block", "stop" and "automatically prevent" point to an IPS.
Placement decides what a sensor can see and whether it can stop anything
A NIDS sits out of band and receives a copy of the traffic from one of two sources. A SPAN port, also called port mirroring, is a switch setting that copies traffic from chosen ports or VLANs to a monitoring port. It needs no extra hardware, but the switch can drop copied packets when the monitoring port is oversubscribed, and it may not copy malformed frames. A network tap is a hardware device installed on a link that copies every frame in both directions. It gives a complete copy, and most taps are built so the monitored link stays up even if the tap loses power, but installing one means briefly breaking the link.
Because an out-of-band sensor only receives a copy, it adds no latency, and if it fails, traffic carries on. The price is that it can only alert.
A NIPS sits inline. It can block, but it adds a little latency, and its failure behavior becomes a design decision. Fail closed means traffic stops when the device fails; fail open means traffic passes uninspected, often through a hardware bypass. Failure modes and device placement in general are covered in the network zones section. A common inline position is just behind the perimeter firewall, where the IPS inspects only traffic the firewall already allowed. Sensors on internal segments are what catch lateral movement, which never crosses the perimeter.
Every network sensor has the same blind spot: encryption. Unless it receives decrypted traffic from a TLS inspection proxy or a load balancer, it sees only metadata such as addresses, ports, server names and, with older TLS versions, certificates.
On the exam, "monitor without affecting production traffic" points to a NIDS on a SPAN port or tap, and "block automatically" points to an inline NIPS.