ISC2 Certified in Cybersecurity (CC) Practice Question

An Intrusion Detection System only monitors and alerts on suspicious traffic but does not interfere with the packets it observes. In contrast, a network-based Intrusion Prevention System sits inline with network traffic and can take immediate preventive action-such as dropping, blocking, or re-routing malicious packets-before they reach their destination. This active blocking function is the defining feature that gives an IPS its preventive power, whereas the other options describe characteristics either of IDS (monitor-only, post-attack analysis) or of host-based tools rather than network devices.