According to the material, which IPS response is considered most effective in stopping attacks?

• A. Dropping packets
• B. Limiting suspicious traffic to a certain percentage of the total bandwidth
• C. Both A and B are equally effective
• D. Neither A nor B

Answer: (A)

Dropping packets is the most effective IPS response because it enforces a hard boundary: the offending traffic is simply discarded and never reaches the target. This immediate disposal prevents the attacker from completing the exploit, protects resources, and minimizes the chance of collateral damage from malicious flows.

Limiting suspicious traffic to a percentage of bandwidth throttles rather than blocks and can still allow harmful packets to slip through, especially during bursts or when an attacker adapts to stay under the cap. It can also degrade legitimate users if thresholds aren’t tuned precisely. While rate limiting can be useful as a mitigation to reduce impact, it does not stop the attack outright the way dropping does.