Which security device actively blocks threats based on detection, rather than just alerting?

Which security device actively blocks threats based on detection, rather than just alerting?

• A. Intrusion Detection System
• B. Firewall
• C. SIEM
• D. Intrusion Prevention System

Answer: (D)

An Intrusion Prevention System is designed to act in real time to stop threats as soon as they are detected. It sits inline in the network path and analyzes traffic for known attack signatures or abnormal behavior. When it detects something malicious, it immediately blocks the offending traffic, resets connections, or applies other countermeasures. This active prevention is what sets it apart from other devices: an IDS merely detects and raises alerts without directly blocking traffic; a firewall enforces access rules but isn’t focused on detecting and automatically thwarting exploits; and a SIEM collects and correlates logs to alert you, but it doesn’t block traffic on its own. The ability to detect and actively block threats as traffic flows is the defining feature of an IPS.

An Intrusion Prevention System is designed to act in real time to stop threats as soon as they are detected. It sits inline in the network path and analyzes traffic for known attack signatures or abnormal behavior. When it detects something malicious, it immediately blocks the offending traffic, resets connections, or applies other countermeasures. This active prevention is what sets it apart from other devices: an IDS merely detects and raises alerts without directly blocking traffic; a firewall enforces access rules but isn’t focused on detecting and automatically thwarting exploits; and a SIEM collects and correlates logs to alert you, but it doesn’t block traffic on its own. The ability to detect and actively block threats as traffic flows is the defining feature of an IPS.