Explain the difference between IDS and IPS, and describe when a NOC analyst should escalate IDS/IPS alerts to the security team.

Sample answer preview

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) serve complementary but distinct roles in network security. An IDS operates in monitoring mode, analyzing network traffic and system activities to detect suspicious patterns or known attack signatures.