What is the difference between a firewall, an IDS and an IPS?

What the interviewer wants to hear

• Firewall allows or blocks traffic based on rules such as IP, port and application
• IDS watches traffic and raises alerts but does not block
• IPS sits inline and can block malicious traffic
• Trade-off: IPS false positives can break legitimate traffic

Model answer

A firewall controls which traffic is allowed, based on rules such as source, destination, port and, in next-generation firewalls, application and user. An IDS, or Intrusion Detection System, looks at a copy of the traffic and compares it with signatures or normal behaviour, then raises an alert for an analyst. It does not stop anything by itself. An IPS, or Intrusion Prevention System, sits inline in the traffic path, so it can drop packets or reset connections when it sees an attack. The trade-off is that an IPS false positive can block real business traffic, so rules are usually tested in detect mode before being switched to block. Many modern firewalls include IPS features, and tools like Suricata can run as either IDS or IPS.

More easy Cybersecurity Analyst questions

• Explain the CIA triad and give a real example of an attack on each part.
• A user reports a suspicious email. How would you analyse it?
• What is a SIEM and how does a SOC analyst use it?
• Explain the difference between hashing, encryption and encoding.
• What is defence in depth, and how would you explain it with a real example?
• What is MFA, and why are some MFA methods stronger than others?
• Explain false positives and false negatives in a SOC. Which is worse, and how do you balance them?
• What is the difference between a vulnerability scan and a penetration test?
• What is the principle of least privilege, and how would you apply it in an organisation?