When an alert rule is matched in a network-based IDS like snort, the IDS does which of the following?

Dropping packets is an inline IPS prevention action - Snort operating as a passive IDS does not modify, block, or drop traffic under any detection rule match.

Snort's rule evaluation engine does not short-circuit on the first match; when an alert rule fires, it logs and generates an alert, then continues evaluating the packet against all remaining rules in the ruleset. This multi-match behavior ensures that a packet triggering one signature can still be detected by additional signatures, providing thorough and overlapping coverage.

Snort does not stop evaluating rules after the first alert match; it processes the packet against all applicable rules before moving on.

Blocking connections by source IP is an active prevention capability belonging to an IPS or integrated firewall, not to a passive IDS operating in detection-only mode.