Which statement best describes the functions of intrusion detection systems and intrusion prevention systems?

Which statement best describes the functions of intrusion detection systems and intrusion prevention systems?

• A. IDS blocks traffic automatically; IPS only logs events.
• B. IDS detects attacks and raises alarms; IPS automatically responds to identified attacks.
• C. IDS and IPS both require manual intervention.
• D. IPS blocks all traffic automatically.

Answer: (B)

The idea being tested is how IDS and IPS differ in handling threats. An IDS monitors network traffic, analyzes it for signs of malicious activity, and then raises alarms or logs events so defenders can investigate. An IPS sits in line with the traffic and can take automatic action to stop identified attacks, such as blocking packets or resetting connections, without human intervention. The statement that best describes their functions is that IDS detects attacks and raises alarms while IPS automatically responds to identified attacks. This distinction captures the passive, monitoring role of IDS versus the active, inline enforcement of IPS. The other descriptions misstate the roles: one attribute wrongly says IDS blocks traffic automatically and that IPS only logs events, which reverses their actual behavior; another implies both systems require manual intervention, whereas IDS and IPS can operate with automated alerting and response; and another claims IPS blocks all traffic automatically, which is impractical and not how IPS is typically configured.

The idea being tested is how IDS and IPS differ in handling threats. An IDS monitors network traffic, analyzes it for signs of malicious activity, and then raises alarms or logs events so defenders can investigate. An IPS sits in line with the traffic and can take automatic action to stop identified attacks, such as blocking packets or resetting connections, without human intervention. The statement that best describes their functions is that IDS detects attacks and raises alarms while IPS automatically responds to identified attacks. This distinction captures the passive, monitoring role of IDS versus the active, inline enforcement of IPS. The other descriptions misstate the roles: one attribute wrongly says IDS blocks traffic automatically and that IPS only logs events, which reverses their actual behavior; another implies both systems require manual intervention, whereas IDS and IPS can operate with automated alerting and response; and another claims IPS blocks all traffic automatically, which is impractical and not how IPS is typically configured.