Which security appliance combines detection capabilities with functions that can actively block attacks?

Which security appliance combines detection capabilities with functions that can actively block attacks?

• A. Intrusion detection system (IDS)
• B. Next-generation firewall (NGFW)
• C. Intrusion prevention system (IPS)
• D. UTM

Answer: (C)

The key idea is combining detection with real-time blocking. An intrusion prevention system is designed to be placed inline in the network path so it can both detect malicious activity and immediately stop it by dropping or resetting suspicious traffic, applying rate limits, or enforcing other defenses as soon as a threat is identified. This real-time blocking capability is what distinguishes prevention from detection-only approaches. An IDS only detects and alerts, leaving blocking to other processes, so it isn’t the best fit when the scenario calls for automatic defense. While next-generation firewalls and UTMs can perform multiple security functions, the description specifically points to a device whose primary purpose is to detect threats and actively block them in real time, which is the hallmark of an intrusion prevention system.

The key idea is combining detection with real-time blocking. An intrusion prevention system is designed to be placed inline in the network path so it can both detect malicious activity and immediately stop it by dropping or resetting suspicious traffic, applying rate limits, or enforcing other defenses as soon as a threat is identified. This real-time blocking capability is what distinguishes prevention from detection-only approaches. An IDS only detects and alerts, leaving blocking to other processes, so it isn’t the best fit when the scenario calls for automatic defense. While next-generation firewalls and UTMs can perform multiple security functions, the description specifically points to a device whose primary purpose is to detect threats and actively block them in real time, which is the hallmark of an intrusion prevention system.