When an administrator adds a predefined IPS signature to a sensor without changing its action, what generally happens?
Select an answer to reveal the explanation.
Short Explanation
Adding a signature and leaving it alone is like accepting a recipe as written — it keeps whatever setting came with it until you decide to change something yourself.
Full Explanation
Predefined IPS signatures carry a recommended default action, and adding one to a sensor without making any changes leaves that recommended action in force until the administrator deliberately overrides it. This means a sensor's real behavior depends heavily on what those inherited defaults actually are, not just on which signatures were selected. The wrong option about disabled logging conflates action with logging — a signature can be actively enforcing its default action while logging is a separate setting layered on top, not a prerequisite for the signature to function. The wrong option claiming automatic escalation to block invents behavior that contradicts the whole idea of a signature having its own recommended default; nothing forces every added signature toward the strictest possible action. The wrong option restricting activity to proxy-based traffic ties IPS enforcement to a specific inspection mode that isn't a general rule about how default actions work. A caveat: an administrator who adds a broad set of signatures without reviewing their defaults can end up with a sensor that is inconsistently strict — some signatures blocking, others only logging — without ever having intended that mix. To catch this, review the sensor's signature table and its action column rather than assuming a uniform action across every signature added.