What is the PRIMARY difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS)?

The correct answer is A. IPS can block network traffic, but IDS can't. The key distinction is that an IPS is deployed inline with traffic, allowing it to actively block or drop malicious packets in real time. An IDS is typically deployed out-of-band (passive/parallel), meaning it monitors a copy of the traffic and generates alerts but cannot block…

Network Security Concepts

Question

Options

AIPS can block network traffic, but IDS can't
BIDS is software-based, while IPS is hardware-based
CIDS detects malware, but IPS doesn't
DIPS is parallel to the traffic, while IDS is in-line

How the community answered

(49 responses)

A
94% (46)
B
4% (2)
C
2% (1)

Explanation

The key distinction is that an IPS is deployed inline with traffic, allowing it to actively block or drop malicious packets in real time. An IDS is typically deployed out-of-band (passive/parallel), meaning it monitors a copy of the traffic and generates alerts but cannot block anything. Note: answer D has the roles reversed - it is actually the IPS that is inline and the IDS that is parallel (out-of-band), making D incorrect despite sounding similar. Both IDS and IPS can be hardware or software, and both can detect malware.

Topics

#IDS/IPS#Network Security#Security Controls

Community Discussion

No community discussion yet for this question.

Full CERTIFIED-IN-CYBERSECURITY Practice