IDSs drop packets that are merely suspicious.

• A. True
• B. False
• C. Both
• D. Neither

Answer: (B)

Understanding IDS vs IPS behavior helps clarify this. An IDS (Intrusion Detection System) is focused on monitoring network traffic, analyzing it for signs of suspicious or malicious activity, and then generating alerts or logs to aid incident response. It does not block or remove traffic by itself. Dropping, blocking, or resetting connections is the function of an IPS (Intrusion Prevention System) or a firewall operating in inline mode, which can actively prevent threats from reaching their targets. Some systems can be configured to take automated action, but that behavior goes beyond a typical IDS and moves toward IPS-like functionality. Therefore, the statement that IDSs drop packets that are merely suspicious is not accurate; IDSs detect and alert, while dropping would be an action of a prevention system.