When deploying an Intrusion Prevention System (IPS) the BEST way to get maximum protection from the system is to deploy it

Question

Options

• AIn promiscuous mode and only detect malicious traffic.
• BIn-line and turn on blocking mode to stop malicious traffic.
• CIn promiscuous mode and block malicious traffic.
• DIn-line and turn on alert mode to stop malicious traffic.

• A
  8% (2)
• B
  85% (22)
• C
  4% (1)
• D
  4% (1)

Explanation

Deploying an IPS in-line with blocking mode enabled (B) is the only configuration that actually stops threats in real time - traffic passes through the IPS before reaching the target, so malicious packets are dropped before they cause harm.

Why the distractors fail:

• A - Promiscuous mode means the IPS receives a copy of traffic (like a tap/span port), so it can only detect and alert, never block. Detection alone is an IDS, not IPS.
• C - Promiscuous mode physically cannot block traffic; the live traffic stream has already bypassed the sensor. Blocking from a copy is impossible.
• D - In-line placement is correct, but "alert mode" only notifies - it does not stop traffic. This describes IDS behavior on IPS hardware.

Memory tip: Think of the "P" in IPS as "Prevent" - to prevent, you must be in the path of traffic (in-line) with blocking on. If you're just watching a copy (promiscuous), you can only detect, which is what an IDS does.

No community discussion yet for this question.