Which of the following would allow you to automatically close connections or restart a server or service when a DoS attack is detected?

An active IDS - also referred to as an Intrusion Prevention System (IPS) - is configured to respond automatically to detected threats by taking defensive actions such as terminating TCP sessions via RST packets, blocking IP addresses, or restarting affected services. This automated response capability is what distinguishes it from a passive IDS, which only logs and alerts.

Signature-based IDS describes the detection method (matching known attack patterns), not whether the system responds actively or passively to threats.

A passive IDS only monitors traffic and generates alerts for human review; it does not take any automated action to stop or mitigate an attack.

Network-based IDS describes the deployment location (monitoring network traffic), not whether the system can actively respond to or terminate attacks.