If an IPS identifies an attack, what actions can it perform?

• A. Drop the attack packet(s)
• B. Limit suspicious traffic to a certain percentage of the total bandwidth
• C. Both A and B
• D. Neither A nor B

Answer: (C)

An intrusion prevention system acts in real time to stop threats as traffic flows through it. When it identifies an attack, it can enforce traffic rules directly in the data path. One common action is dropping packets that match the attack signature, effectively blocking the malicious portion of the traffic. It can also throttle or cap the rate of suspicious traffic, preventing a flood from consuming all bandwidth and helping keep legitimate users’ access available. Many IPS devices support both actions, applying them based on policy and the severity of the threat. This inline enforcement is what lets an IPS not only detect but also actively prevent attacks, unlike a passive IDS which only monitors and reports.