Use intrusion-detection and/or intrusion-prevention techniques to detect and/or prevent intrusions into the network. Monitor all traffic at the perimeter and critical points in the CDE, and alert personnel to suspected compromises. Keep IDS/IPS engines, baselines, and signatures up to date.

Use intrusion-detection and/or intrusion-prevention techniques to detect and/or prevent intrusions into the network. Monitor all traffic at the perimeter and critical points in the CDE, and alert personnel to suspected compromises. Keep IDS/IPS engines, baselines, and signatures up to date.

• A. Not Recommended
• B. Use IDS/IPS And Update Regularly
• C. Update Not Necessary
• D. Only Monitor At Perimeter

Answer: (B)

Using IDS/IPS with up-to-date engines, baselines, and signatures is essential for timely detection and prevention of intrusions in the network. IDS/IPS monitors traffic at the network perimeter and at critical points in the CDE, looking for known attack patterns and anomalous behavior defined by Baselines. Keeping the detection rules and the system’s software current lets you recognize the latest threats and reduce dwell time, while alerts enable rapid incident response. This approach provides defense-in-depth: you’re not relying on one control, but continuously watching, updating, and reacting to suspicious activity across the places that matter most for cardholder data. Choosing not to use IDS/IPS, or to skip regular updates, creates blind spots or reliance on outdated signatures, and monitoring only at the perimeter misses internal movement and other critical points.

Using IDS/IPS with up-to-date engines, baselines, and signatures is essential for timely detection and prevention of intrusions in the network. IDS/IPS monitors traffic at the network perimeter and at critical points in the CDE, looking for known attack patterns and anomalous behavior defined by Baselines. Keeping the detection rules and the system’s software current lets you recognize the latest threats and reduce dwell time, while alerts enable rapid incident response. This approach provides defense-in-depth: you’re not relying on one control, but continuously watching, updating, and reacting to suspicious activity across the places that matter most for cardholder data.

Choosing not to use IDS/IPS, or to skip regular updates, creates blind spots or reliance on outdated signatures, and monitoring only at the perimeter misses internal movement and other critical points.