What describes an intrusion prevention system (IPS)?

• A. An intrusion prevention system that only logs events.
• B. An intrusion detection system that blocks traffic.
• C. A firewall that blocks all traffic by default.
• D. An intrusion prevention system that can detect intrusions and also block attempted intrusions.

Answer: (D)

An intrusion prevention system is designed to protect by both identifying threats and taking immediate action to stop them. It sits in line with network traffic so it can block malicious activity as it happens, such as dropping harmful packets or resetting connections, in addition to detecting intrusions. That combination—detecting intrusions and actively blocking attempted intrusions—is what defines an IPS.

The description that portrays it as logging-only misses the protective action and isn’t accurate for an IPS. The idea of an IDS blocking traffic conflates two different concepts: IDSs detect and alert, while IPSs perform the blocking. The notion of a firewall that blocks all traffic by default describes a firewall policy, not the specific behavior of an IPS.