An administrator is testing a new web server from outside of the corporate firewall. The administrator performs a test from a single PC and the web server responds accordingly. The administrator…

An IPS inspects packet content for known attack signatures and can drop malicious traffic, but connection-level rate limiting triggered by a NAT IP flood is primarily a firewall function, not an IPS function.

Blacklisting blocks known-bad IP addresses and would have prevented the single-PC test from succeeding as well, since neither the PC nor the VMs would be pre-listed as malicious.

An IDS passively monitors traffic and generates alerts but does not block connections, so it cannot prevent the VMs from reaching the web server.

Whitelisting would have blocked the VMs entirely from the start rather than only after simultaneous connections were attempted, and would also have blocked the single-PC test if that IP were not on the allowed list.

Firewalls can enforce rules that limit the number of concurrent connections or the connection rate from a single source IP. Because all VMs behind the NAT gateway share one external IP, their simultaneous requests appear as a connection flood from that single address, causing the firewall to block traffic from it - while the earlier single-PC test did not exceed any threshold.