Which system is designed to detect intrusions and take actions to prevent them, often deployed behind firewalls?

Which system is designed to detect intrusions and take actions to prevent them, often deployed behind firewalls?

• A. Firewall
• B. Intrusion prevention systems (IPS)
• C. Demilitarized Zone (DMZ)
• D. Bastion Host

Answer: (B)

Detecting and stopping intrusions in real time is what an intrusion prevention system does. An IPS sits inline in the network and watches traffic, using signatures and anomaly detection to identify malicious activity. When it detects something, it can automatically block packets, reset connections, or apply other preventative actions, preventing the threat from reaching hosts. This proactive capability is what sets it apart from a simple firewall, which mainly enforces access rules, and from an IDS, which only detects and alerts without automatically stopping traffic. It is commonly placed behind a firewall so that traffic has already been filtered at the edge, but the IPS can still inspect it and block anything malicious that evades the firewall.

Detecting and stopping intrusions in real time is what an intrusion prevention system does. An IPS sits inline in the network and watches traffic, using signatures and anomaly detection to identify malicious activity. When it detects something, it can automatically block packets, reset connections, or apply other preventative actions, preventing the threat from reaching hosts. This proactive capability is what sets it apart from a simple firewall, which mainly enforces access rules, and from an IDS, which only detects and alerts without automatically stopping traffic. It is commonly placed behind a firewall so that traffic has already been filtered at the edge, but the IPS can still inspect it and block anything malicious that evades the firewall.