Which statement describes IPS threat mitigation?

• A. It blocks all traffic without evaluation
• B. It logs events and never blocks traffic
• C. It encrypts all matching traffic
• D. It drops malicious requests when the threat has a risk classification above a predefined threshold

Answer: (D)

IPS threat mitigation involves actively blocking malicious traffic in real time based on evaluation and risk scoring. An inline system inspects traffic, applies signatures and heuristics, and, when a threat is given a risk classification above a predefined threshold, it drops the offending requests (often with possible connection resets or alerts). This proactive action is what turns detection into prevention, stopping threats before they reach targets.

The other statements don’t fit because they describe non-mitigation behaviors: blocking all traffic without evaluation is not how IPS works, as it would disrupt legitimate traffic; logging without blocking describes an IDS stance rather than an IPS; encrypting matching traffic is about confidentiality, not mitigating or stopping threats.