Which statement about IPS is true?

• A. It blocks all traffic without evaluation
• B. It only logs events and never blocks traffic
• C. It can drop malicious requests when the threat has a risk classification above a predefined threshold
• D. It replaces a firewall entirely

Answer: (C)

An IPS inspects traffic in real time and can take action when a threat is detected. It uses known attack signatures or unusual behavior to assign a risk level to each pattern. When that risk exceeds a predefined threshold, the IPS drops the malicious request or resets the connection, effectively preventing the intrusion. This inline blocking capability is what differentiates an IPS from a system that only logs events, and it works alongside a firewall rather than replacing it. The other statements don’t fit because an IPS does not block all traffic indiscriminately, it does more than just logging, and it isn’t intended to replace a firewall.