What are the operational phases of an Intrusion Detection system?

• A. Alert, Dispatch, and Recovery
• B. Detection, Reporting, Dispatch, and Response/Assessment
• C. Sensing, Escalation, Notification, and Action
• D. Monitoring, Alarm, Verification, and Containment

Answer: (B)

The question tests how an Intrusion Detection System moves from spotting activity to taking action. The best description is a progression that starts with detection of potential threats, then reporting to the security team or system, followed by dispatching a response (whether automated or human), and finally carrying out the response and assessing its effectiveness. This sequence captures the full operational flow of an IDS: you first recognize something unusual, tell the right people or systems, initiate a coordinated response, and then verify that the threat is mitigated.

Other options don’t align as well with how IDS workflows are typically described. One focuses only on alerting, dispatch, and recovery and omits the essential detection and reporting steps. Another uses different terms that don’t map cleanly onto the standard stages of detection, notification, escalation, and action. The last option centers on monitoring and containment but treats containment as a standalone phase and doesn’t fully include the detection, reporting, and assessment aspects that complete the cycle.