CompTIA Security+ Exam Prep

Answer: A - Network-based IDS uses sensors and is usually in promiscuous mode. A network-based IDS uses sensors, which are either host computers with the necessary software installed or dedicated appliances-each with its network interfaces card (NIC) in promiscuous mode. Normally, NICs watch for traffic that has the address of its host system, broadcasts, and sometimes multicast traffic. When an NIC is put into promiscuous mode, the NIC driver captures all traffic, makes a copy of all packets, and then passes one copy to the TCP sack and one copy to an analyzer to look for specific types of patterns.