Intrusion Detection and Prevention Systems Questions

Covers the principles, capabilities, deployment models, and limitations of intrusion detection systems and intrusion prevention systems. Topics include differences between host based and network based detection, signature based and anomaly based detection approaches, common tools and sensor types such as Snort, Zeek, and Suricata, deployment placements and monitoring points, evasion techniques and limitations, integration with threat intelligence feeds, and practical workflows for investigating alerts using packet capture files and flow data. Candidates should also be prepared to discuss trade offs between detection sensitivity and operational cost, use cases for prevention versus detection, sensor scaling and placement, and how these systems fit within a layered defensive architecture alongside endpoint detection and firewalls.