1. What is the difference between an IDS and an IPS? 2. Why is it important to perform a network traffic baseline definition analysis? 3. Why is a port scan detected from the same IP on a subnet an alarming alert to receive from your IDS? 4. If the Snort IDS captures the IP packets off the LAN segment for examination, is this an example of promiscuous mode operation? Are these packets saved or logged