Which of the following describes the capabilities of IPSs when facing an attack?

• A. Drop packets
• B. Limit bandwidth
• C. Both
• D. Neither

Answer: (C)

Intrusion Prevention Systems sit inline and actively intervene as threats are observed. They can drop packets that match attack signatures or violate policy, preventing the exploit from reaching its target. They can also limit bandwidth by rate-limiting traffic from a suspicious source or of a certain type, which helps blunt floods and protects resources while still allowing legitimate traffic at a controlled rate. Because an IPS can both block offending packets and throttle traffic, describing its capabilities during an attack as both is most accurate. Restricting to only dropping packets misses the protective benefit of throttling, and claiming neither would ignore the proactive actions an IPS is designed to take.