2.2.2. Security and Storage Appliances

IDS (Intrusion Detection System): Monitors traffic and alerts on suspicious activity. Passive—doesn't block traffic, just detects and notifies. Sits out-of-band (receives copies of traffic).

IPS (Intrusion Prevention System): Monitors traffic and actively blocks threats. Inline—traffic flows through it, allowing it to drop malicious packets. The "P" means it takes action.

⚠️ Exam Trap: IDS detects and alerts; IPS detects and prevents. If a question asks about "mitigating" or "preventing" attacks inline, IPS is correct. If it asks about "detecting" or "alerting" without blocking, IDS is correct.

Enforce vs. observe: Firewalls, IPS, and NAC sit in the path of traffic (or of network admission) and can block it. An IDS, a SIEM (which correlates logs from many sources), and a honeypot (a decoy that lures attackers) only watch and alert—none of them can drop traffic headed for real hosts.

Proxy: Intermediary that makes requests on behalf of clients. Can cache content (improving performance), filter URLs (blocking categories), and hide client IPs (privacy). Forward proxy serves internal clients accessing external resources. Reverse proxy serves external clients accessing internal resources (often for load balancing or security). A transparent proxy intercepts traffic in the network path without any client configuration—users don't know it's there. Explicit proxies (including SOCKS proxies) work only when each client is configured to use them.

NAS vs. SAN: