Explain the difference between an IDS and an IPS.

These two technologies look almost identical on paper — both inspect traffic for malicious patterns — but one watches and one acts, and that difference drives where and how you deploy them.

IDS — Intrusion Detection System

An IDS monitors and alerts. It typically receives a copy of traffic out-of-band (via a SPAN port or network tap), so it isn't in the live data path. When it spots something suspicious, it generates an alert for a human to investigate. Because it can't drop packets, a false positive is harmless — it just creates noise. The downside is that it doesn't stop anything on its own; by the time you react, the traffic has already passed.

IPS — Intrusion Prevention System

An IPS sits inline, directly in the traffic path, so it can block, drop, or reset connections in real time. This means it can actually stop an attack as it happens. The cost is risk: a false positive can drop legitimate traffic and cause an outage, and because it's inline, it can become a performance bottleneck or a single point of failure.

Detection methods

Both can use signature-based detection (matching known-bad patterns — fast and precise but blind to novel attacks) and anomaly-based detection (flagging deviations from normal — catches new threats but generates more false positives).

How teams use them

Many organizations tune rules in IDS (alert-only) mode first to measure false positives, then promote trusted rules to IPS blocking mode once confident. This balances prevention against the risk of breaking production.

Why this matters

Interviewers want the core distinction — detect/alert versus inline/block — plus awareness of the tradeoff. Mentioning that you'd test rules in detection mode before enabling blocking shows operational maturity, not just textbook recall.