Which cybersecurity control is used to monitor for suspicious network activity?

• A. Encryption
• B. VPN
• C. Intrusion Prevention System
• D. Intrusion Detection System

Answer: (D)

Monitoring for suspicious network activity is what an Intrusion Detection System does. An IDS continuously watches network traffic, analyzes patterns or known attack signatures, and raises alerts when something looks abnormal. It’s designed to detect potential breaches and notify security personnel, often logging events for further investigation. It can be deployed on the network (to monitor traffic across segments) or on individual hosts.

Encryption protects data as it travels, but it doesn’t watch for or flag suspicious activity. A VPN creates a secure, encrypted tunnel for remote access; it also isn’t focused on detecting intrusions. An Intrusion Prevention System can also monitor traffic, but it adds the ability to block or drop traffic to prevent harm, whereas an IDS mainly detects and alerts so responders can investigate. For the goal of monitoring for suspicious network activity, the Intrusion Detection System is the best fit.