IDS vs IPS: detection vs mitigation. Which statement best describes?

• A. IDS never detects threats.
• B. IPS relies solely on signatures.
• C. IPS actively blocks/mitigates traffic in real-time.
• D. IDS can only log events, never alert.

Answer: (C)

The idea being tested is how IDS and IPS differ in handling threats: detection versus real-time mitigation. An Intrusion Prevention System sits directly in the path of network traffic and can actively block or mitigate threats as they flow by. It can drop malicious packets, reset connections, or even modify traffic to stop an attack before it reaches its target. An Intrusion Detection System, by contrast, watches and analyzes traffic (often out-of-band or in a passive mode), flags potential threats, and sends alerts or logs for human responders to investigate. It does not automatically block traffic by itself.

That’s why the statement that an IPS actively blocks/mitigates traffic in real-time is the best description. It captures the enforcement role that IPS systems perform, in contrast to IDS, which focuses on detection and alerting. The other ideas aren’t accurate: IDS can detect threats and alert; an IPS can use more than just signatures (it also uses behavior, heuristics, and policy-based rules); and IDS can log events and generate alerts rather than being limited to passive logging.