Network engineers must choose between an inline IPS and a tap/monitor IDS for a county uplink. Which distinction is correct?
Select an answer to reveal the explanation.
Short Explanation
Inline IPS is a checkpoint in the road that can stop a car; a tap IDS is a camera on the shoulder that watches. One prevents in-path, the other mainly detects. Mixing those roles muddies design choices.
Full Explanation
An inline intrusion prevention system sits in the forwarding path and can actively block or drop traffic matching malicious signatures or behaviors, trading potential latency and availability impact for preventive capability on a county uplink. A tap or monitor-mode intrusion detection system receives a copy of traffic (SPAN/TAP) and typically detects and alerts passively without sitting in-line, so it cannot directly block frames but also cannot become a single point of failure for the uplink in the same way. Security+ expects clear distinction: IPS prevents in-path; IDS primarily detects out-of-band.
Claiming tap/monitor IDS always blocks exploits faster than any inline IPS reverses the roles—passive IDS does not block by sitting off-path. Saying inline IPS can only alert and never influence traffic describes IDS-like behavior, not IPS. Asserting IDS and IPS placements are identical so naming does not matter erases a core design decision about blocking versus detecting.
Exam caveat: watch for swapped definitions; inline/blocking versus tap/alerting is the tested distinction. Operationally, if choosing inline IPS, plan high-availability, fail-open/fail-closed policy for the appliance itself, tuning to reduce false-positive blocks on citizen services, and change control for signature updates; if choosing tap IDS, ensure the SOC can respond quickly because detection alone will not stop the packet.