A university wants a device that sits in the path between the dorms and the data center and drops a known exploit before it reaches a server. A device that only receives a mirrored copy and sends an alert would be too late. Which appliance matches the requirement?
Select an answer to reveal the explanation.
Short Explanation
Detection is a smoke alarm, and prevention is a sprinkler that can actually put the fire out. You asked for a device in the path that drops the exploit, and that is an intrusion prevention system. A detector on a mirrored copy, or a firewall that only tracks the session, can watch the packet go by and still not drop that exploit.
Full Explanation
An intrusion prevention system is placed inline, so the packet has to pass through it. When a signature matches, the IPS can discard the packet and keep the exploit from arriving at the server. That is the dorm-to-data-center placement the university described. An intrusion detection system is the near miss. It sees the same signature, often from a mirror or a tap, and it alerts. The copy it inspected is not the packet still in flight, and the stem says an alert-only mirror is too late. A stateful firewall that tracks the session and has no exploit signature will forward a well-formed connection. Being in the path is not enough when the device is not looking at the exploit. A reverse proxy can publish the server and sit in the path too. Publishing the site does not drop a known exploit unless the proxy is actually doing prevention. Exam caveat: an IPS can become a bottleneck or block a legitimate flow when a signature is wrong. Inline placement is a capacity and change-management decision, not only a security one. Operational check: confirm the appliance is bridged in the path rather than attached to a mirror port, generate a benign test signature, and verify the matching packet is dropped and logged.