An Intrusion Detection System (IDS) is composed of a combination of components integrated to operate in a specific manner to detect a change in the environment by a change of state of detection device.

• A. True
• B. False
• C. It is composed of a combination of components integrated to operate in a specific manner to detect a change in the environment by a change of state of detection device
• D. It relies on manual monitoring only

Answer: (C)

An IDS works by integrating several components that are designed to operate together to detect intrusions. These components—such as sensors or detectors to observe the environment, data collection and processing elements, analysis and correlation engines, and response or alert mechanisms—work in a defined way to notice changes in the environment. When a detection device changes state (for example, a sensor goes from idle to triggered), the system can recognize that change and generate an alert or take action. This automated, interconnected setup is what allows an IDS to monitor for intrusions rather than relying on manual monitoring alone. That description aligns precisely with how an IDS is structured and functions, making it the best characterization. The other choices either reduce the concept to a vague claim, imply only manual monitoring, or miss the idea of the integrated, state-change-driven detection process.