A network intrusion detection sensor connected to a mirrored switch port correctly alerted on exploit traffic aimed at a public web server, but it could not stop the traffic. The team now wants that traffic dropped automatically at the network perimeter. Which control should it deploy?
Select an answer to reveal the explanation.
Short Explanation
An IDS on a mirror port is a security camera: great footage, but it can't tackle anybody. An IPS sits inline like a bouncer at the door, so it can actually drop the bad traffic. You want blocking at the perimeter, so you've got to be in the path, not watching a copy.
Full Explanation
A network intrusion prevention system sits inline in the traffic path, so every packet passes through it before reaching its destination. When traffic matches a malicious signature or behavior, it can drop the packets, reset the connection or block the source, stopping the exploit rather than merely reporting it. A network intrusion detection system on a mirrored port receives only a copy of the traffic, which is why it could alert but not intervene; adding a second detection sensor on another mirrored port increases visibility but still cannot block anything. Host intrusion detection on each server monitors local activity and logs suspicious events, but detection systems do not block, and host-based tools act on the server rather than at the network perimeter the team specified. A security information and event management correlation rule that raises alert priority helps analysts notice the event faster, yet a human or downstream automation would still have to act, and the exploit traffic would already have reached the server. Exam caveat: inline prevention introduces a failure mode, so the team must decide whether the device fails open or fails closed and must tune signatures to avoid blocking legitimate traffic. Operational check: confirm the prevention system is cabled inline between the perimeter and the web server, replay a known exploit test pattern, and verify it is dropped and logged.