A cloud security team wants to stop known exploit traffic before it reaches its web servers, and separately wants to study attacker techniques without putting production systems at risk. Which combination fits these goals?

An intrusion prevention system sits inline, so every packet passes through it, and it can drop or reset sessions that match exploit signatures or anomaly rules before they reach the protected servers. An intrusion detection system typically receives a copy of traffic from a mirrored port or tap; because it is out of band, it can alert but cannot reliably block. A honeypot is a decoy system with no production purpose, deliberately exposed to attract attackers so that their tools, techniques and indicators can be studied; it must be isolated from production so that an attacker who compromises it gains no foothold. Placing a mirrored-port IDS in the blocking role fails because detection alone does not stop exploits, and putting a honeypot inside the production subnet gives attackers a stepping stone toward real assets. A vulnerability scanner identifies weaknesses in the organization's own systems; it does not observe attacker behaviour and running it is not intelligence collection. A honeypot cannot block exploits aimed at real servers, and an IDS is a detection tool rather than a research environment. Exam caveat: legal review is advisable before operating honeypots, and they must never be used to entrap or to attack back. Operational check: confirm that the IPS is deployed in blocking mode on the path to the web tier and fails in the documented manner, and that the honeypot's network has no routes to production and its activity feeds threat intelligence.