How does a firewall differ from an intrusion detection system (IDS)?

• A. Firewall enforces access control at network boundaries.
• B. IDS enforces access control at network boundaries.
• C. Firewall enforces access control at network boundaries; IDS monitors for suspicious activity and alerts; they complement each other.
• D. IDS blocks traffic at the boundary and firewall logs alerts.

Answer: (C)

This question hinges on the distinction between enforcement at the network boundary and detection of threats. A firewall actively enforces access control by filtering traffic according to policy, deciding what to permit or block as data crosses network borders. An intrusion detection system monitors traffic for signs of malicious activity and raises alerts; by itself it typically doesn’t block traffic. Because these roles address different needs, they best fit together: the firewall provides policy-based protection at the edge, while the IDS provides visibility and alerting about what’s happening on the network. This combination gives both enforcement and detection, strengthening overall security. The claim that the IDS enforces boundary access or that the IDS blocks traffic is a misunderstanding unless you’re talking about an inline IPS, which is a different capability.