An intrusion detection system should be placed:

A. outside the firewall.

B. on the firewall server.

C. on a screened subnet.

D. on the external router.

Explanation:

An intrusion detection system (IDS) should be placed on a screened subnet, which is a demilitarized zone (DMZ). Placing it on the Internet side of the firewall would leave it defenseless. The same would be tmc of placing it on the external router, if such a thing were feasible. Since firewalls should be installed on hardened servers with minimal services enabled,it would be inappropriate to store the IDS on the same physical device.