If an organization were to deploy only one Intrusion Detection System (IDS) sensor to protect its information
system from the Internet:

A.
It should be host-based and installed on the most critical system in the DMZ, between the external router
and the firewall.

B.
It should be network-based and installed in the DMZ, between the external router and the firewall.

C.
It should be network-based and installed between the firewall to the DMZ and the intranet.

D.
It should be host-based and installed between the external router and the Internet.

Explanation:
Network Intrusion Detection Systems (NIDS) are placed at a strategic point, such as between the internetfacing router and the firewall, within the network to monitor traffic to and from all devices on the network.
Incorrect Answers:
A: A host-based IDS is an IDS that is installed on a single computer and can monitor the activities on that
computer only.
C: It is better to place the IDS between the DMZ and the internet.
D: A host-based IDS is an IDS that is installed on a single computer and can monitor the activities on that
computer only.

https://en.wikipedia.org/wiki/Intrusion_detection_system