Two IPS actions available for a matched signature are "block" and "reset." In general terms, what distinguishes "reset" from a plain "block" when a match occurs on TCP traffic?
Select an answer to reveal the explanation.
Short Explanation
Block is like hanging up on someone without a word — they just sit there wondering if the call dropped. Reset is like telling them straight out the call is over, so their side closes cleanly right away instead of waiting to time out.
Full Explanation
A reset action drops the matched traffic and additionally sends a TCP reset toward the sender, which tears down the connection state immediately instead of leaving the sending host to eventually time out waiting for a response that will never come. This gives faster, cleaner connection teardown compared to a silent drop. The first wrong option claims reset behaves identically to a silent block, which erases the exact distinction the question is asking about — the reset signal is the whole point of the action. The second wrong option restricts reset to UDP traffic, but a TCP reset is by definition a TCP-layer mechanism and doesn't apply the way the option describes; the question is specifically about TCP traffic being reset. The third wrong option introduces re-encryption, something unrelated to what a reset action does — closing a connection has nothing to do with encrypting it. A caveat worth weighing for a substation-facing sensor: sending a visible reset can tip off whoever generated the matched traffic that something is actively filtering it, which is a tradeoff against the faster, cleaner teardown a reset provides compared to a silent drop. To see the difference directly, trigger a test match and capture the session, comparing the TCP reset flag's presence against a signature configured to simply block and drop.