Comprehensive and Detailed Explanation From Exact Extract:
Intrusion detection is the process of using monitoring tools and systems to identify and alert on unauthorized or suspicious activities on networks or hosts, often in real time. Intrusion Detection Systems (IDS) analyze traffic or system events to detect:
Unauthorized access attempts
Malicious or abnormal behavior
Known attack signatures or anomalies
When potential intrusions are detected, these systems can generate alerts, and in some configurations (IDS/IPS), they may also help automate responses or integrate with other security tools.
Why the other options are incorrect:
A. Penetration testing – Simulates attacks to find vulnerabilities but is periodic and manual, not continuous real-time monitoring.
B. Access control – Governs who is allowed to access what (through authentication and authorization). It is preventive, not primarily focused on real-time detection of unauthorized attempts once they occur.
C. Log review – Involves analyzing stored logs, often after the fact, for auditing or investigation. It is not necessarily real-time detection.
Therefore, the correct answer is D. Intrusion detection, because it is the process that specifically uses monitoring tools to detect and respond to unauthorized access attempts in real time.
[Reference:Information Technology Management study materials – Security Operations: Monitoring, Intrusion Detection, and Incident Response., , ]