Which technique helps determine if an IP or service is a source of threat?

Which technique helps determine if an IP or service is a source of threat?

• A. Cisco IPS Source IP Reputation Filtering
• B. Packet Traceback
• C. Traffic Pattern Analysis
• D. Rate limiting

Answer: (A)

Threat intelligence via IP reputation filtering examines incoming addresses against lists of known malicious sources and assign reputations to services. This lets a security system quickly decide if traffic is likely to come from a threat source and should be blocked or flagged. It directly answers whether a given IP or service is tied to malicious activity by checking established threat feeds and real-time updates, making it a proactive defense. Packet traceback, on the other hand, focuses on reconstructing the path a particular packet took through the network, which is useful for tracing incidents but not for determining if the source is inherently malicious. Traffic pattern analysis looks at overall behavior to spot anomalies, but it doesn’t label specific IPs or services as threats by themselves. Rate limiting restricts traffic flow to prevent overload or abuse; it doesn’t identify the threat source.

Threat intelligence via IP reputation filtering examines incoming addresses against lists of known malicious sources and assign reputations to services. This lets a security system quickly decide if traffic is likely to come from a threat source and should be blocked or flagged. It directly answers whether a given IP or service is tied to malicious activity by checking established threat feeds and real-time updates, making it a proactive defense.

Packet traceback, on the other hand, focuses on reconstructing the path a particular packet took through the network, which is useful for tracing incidents but not for determining if the source is inherently malicious. Traffic pattern analysis looks at overall behavior to spot anomalies, but it doesn’t label specific IPs or services as threats by themselves. Rate limiting restricts traffic flow to prevent overload or abuse; it doesn’t identify the threat source.