A security breach occurred in a datacenter. An analysis of the HIPS log files on a sever reveals an intrusion was logged, but no action was taken to prevent the intrusion. Which of the following…

Block mode instructs the HIPS to take active preventive action against detected intrusion attempts, dropping malicious traffic or terminating the offending process before damage occurs. It also generates an alert or log entry, fulfilling the requirement to both prevent and notify. The existing configuration only logged the event, meaning it was likely set to a passive detection mode rather than an active prevention mode.

Warn mode notifies an administrator of suspicious activity but does not take action to stop the intrusion, leaving the system vulnerable.

Allow mode explicitly permits the traffic or action and takes no protective or alerting action against the detected threat.

Log mode records the event for later review but, like the current configuration, does not prevent the intrusion from completing.