________ drop packets.

• A. Firewalls
• B. IDSs
• C. Both A and B
• D. Neither A nor B

Answer: (A)

Dropping packets is a primary action of firewalls because they enforce access control policies at the network boundary. When traffic violates a rule—such as coming from a blocked source, using an disallowed protocol, or not matching an allowed state—the firewall can discard (drop) the packet to prevent it from reaching its destination. Stateful firewalls also inspect the context of connections and can drop packets that don’t belong to an allowed connection state, further enforcing security policies.

Intrusion Detection Systems, on the other hand, are designed to monitor and analyze traffic for signs of malicious activity and to generate alerts. They do not block traffic by themselves. An IDS can be deployed inline as part of an Intrusion Prevention System (IPS) or integrated with other devices to trigger blocks, but the typical IDS’s role is detection and alerting rather than dropping packets.