A cybersecurity analyst is setting up a security control that monitors network traffic and produces an active response to a security event. Which of the following tools is the analyst configuring?

EDR (Endpoint Detection and Response) focuses on monitoring and responding to threats on individual endpoints, not actively monitoring and responding to *network* traffic as described.

An Intrusion Prevention System (IPS) is designed to actively monitor network traffic for known attack signatures or anomalous behavior and automatically take predefined actions to block, drop, or reset malicious connections in real-time. This active response capability directly matches the description of a control that both monitors and produces an active response to security events.

CASB (Cloud Access Security Broker) focuses on security for cloud services, governing access, data, and threats within cloud environments, not general network traffic monitoring and active prevention.

A WAF (Web Application Firewall) protects web applications from attacks by filtering and monitoring HTTP traffic, but it's specific to web applications and not a general network traffic active response system.