What must be kept up to date for IDS/IPS systems?

• A. Licenses
• B. Hardware inventory
• C. Baselines and signatures
• D. User accounts

Answer: (C)

IDS/IPS effectiveness hinges on keeping two things current: baselines of normal network behavior and threat signatures. Baselines define what normal traffic looks like for your environment, so the system can spot deviations that could indicate intrusions. Signatures are the actual patterns, rules, or fingerprints that identify known threats and exploits; updating them ensures the system can recognize and block the latest attacks. If signatures aren’t updated, new malware and exploit techniques may slip through, and if baselines aren’t refreshed with legitimate changes in traffic, the system may miss true anomalies or generate unnecessary alerts. Licenses, hardware inventory, and user accounts aren’t what keep the IDS/IPS capable of detecting threats.