Which mode of IPS deployment enforces blocking actions on malicious traffic?

Question

Options

• Aout-of-band
• Binline
• Cmonitor
• Dpassive

• A
  4% (1)
• B
  92% (22)
• C
  4% (1)

Explanation

Inline mode positions the IPS directly in the path of network traffic, meaning all packets physically pass through the device - this is what enables it to drop, block, or modify malicious packets in real time before they reach their destination.

Why the distractors are wrong:

• A (out-of-band) and D (passive) are essentially the same concept: the IPS receives a copy of traffic (via a TAP or SPAN port) and can only alert - it cannot block because packets have already passed by the time analysis occurs.
• C (monitor) describes an operational mode focused on observation and alerting, not enforcement - similar to passive/out-of-band in that no blocking action is taken.

Memory tip: Think "inline = in the way." If the IPS is physically in the way of traffic (like a toll booth), it can stop cars. If it's just watching from the side (passive/out-of-band), it can only take notes.

No community discussion yet for this question.