Which network device is designed to detect suspicious activity on the network?

• A. Intrusion Detection System (IDS)
• B. Firewall
• C. Router
• D. Switch

Answer: (A)

Detecting suspicious activity on the network is the job of an intrusion detection system. An IDS continuously monitors traffic or host events, comparing what’s happening to known attack patterns and identifying unusual behavior. When something looks out of the ordinary, it raises alerts so security teams can investigate and respond. A firewall focuses on blocking or allowing traffic based on rules, not on ongoing monitoring for intrusions. A router simply moves packets between networks, and a switch forwards frames within a local network. Neither is designed to detect malicious activity as its primary function, which is why the IDS is the best fit for this purpose.