Which of the following would allow you to automatically close connections or restart a server or service when a DoS attack is detected?

A signature-based IDS identifies known attacks by matching traffic patterns to a database of signatures but does not describe the response mechanism.

A network-based IDS describes the sensor placement on the network segment, not whether it actively responds or only alerts.

A passive IDS only monitors and generates alerts or logs when an attack is detected; it takes no automated action to stop or mitigate the attack.

An active IDS monitors traffic and, upon detecting an attack signature or anomaly, automatically executes a response such as terminating suspicious connections, blocking source IPs, or restarting affected services. This automated response capability is what differentiates an active IDS from a passive one. In a DoS scenario, the active IDS can close the flood of connections without requiring manual administrator intervention.