What Intrusion Detection System (IDS) operational phase requires human interaction?

• A. Monitoring
• B. Design
• C. Dispatch
• D. Maintenance

Answer: (C)

The phase that requires human interaction is the one where alerts are handed off and responders are coordinated. After the IDS detects something, automated systems can triage and filter alerts, but the actual response action—deciding what to do, who to notify, and how to contain or remediate the incident—needs a person to assess, escalate, and coordinate the incident response. This dispatch step involves notifying the right security personnel, opening incident tickets, and communicating with stakeholders to drive the recovery process.

The other phases are more about setup and ongoing operation: design is about planning the system architecture; monitoring is the continuous observation and automated alerting; maintenance covers updates, tuning, and upkeep.