When an alert rule is matched in a network-based IDS like snort, the IDS does which of the following?

Dropping packets is an IPS (inline mode) function - a passive network IDS like Snort in sensor mode has no capability to drop or modify traffic in transit.

Snort's detection engine evaluates a packet against all configured rules sequentially, not just until the first match. When an alert rule fires, Snort generates the alert and logs the event, but then continues checking remaining rules - this means a single packet can trigger multiple alerts if it matches more than one signature.

While Snort does send an alert and allows the packet to pass in IDS mode, it does NOT stop rule evaluation after the first match - continuing to check all rules is a key behavioral distinction from firewall ACLs.

Blocking connections by source IP is an active response or IPS behavior that a passive IDS cannot perform because it monitors a copy of traffic out-of-band and is not inline with the data path.