Which component does not drop packets?

• A. IDSs
• B. IPSs
• C. Firewalls
• D. All of the above drop packets

Answer: (A)

The key idea is detection versus enforcement. An IDS is built to monitor and analyze traffic and raise alerts when something suspicious is found, rather than actively blocking it. While an IDS can be placed in-line in some setups, its primary role is observation, not dropping packets. In contrast, an intrusion prevention system sits inline and can drop or modify traffic that matches malicious patterns, and a firewall enforces policies that often result in dropping packets that don’t meet those rules. So, the component that does not drop packets by default is the IDS.