An intrusion detection system (IDS) should:
A.
run continuously
B.
ignore anomalies
C.
require a stable, rarely changed environment
D.
be located on the network
Explanation:
If an intrusion detection system (IDS) does not run continuously the business remains vulnerable. An IDS should detect, not ignore anomalies. An IDS should be flexible enough to cope with a changing environment.
Both host and network based IDS are recommended for adequate detection.