Which IPS Mode Blocks Signature-Based Attacks?

SY0-701 By islever Editorial Last updated

Short answer

D Active

Question

A security engineer is installing an IPS to block signature-based attacks in the environment. Which of the following modes will best accomplish this task?
  1. Monitor
  2. Sensor
  3. Audit
  4. Active Correct Answer

Key Takeaways

Tests the distinction between detection-only and prevention-capable IPS deployments, with the common trap being confusion between monitoring modes that merely log traffic versus those that enforce inline blocking.

This question evaluates your understanding of Intrusion Prevention System (IPS) operational modes and their real-time threat mitigation capabilities. The community unanimously agrees that active mode is the only configuration that automatically blocks known attack signatures.

Common mistake: Monitor (A) is frequently selected by candidates who conflate IDS and IPS functionalities, overlooking that monitor mode only copies traffic for analysis and alerts administrators without disrupting malicious flows.

Expert Analysis

Why the Answer Is Correct

Active mode is the correct choice because it places the IPS inline with network traffic, enabling it to inspect packets and immediately drop malicious payloads or reset connections when known signatures are matched. Unlike passive systems, this configuration enforces security policies autonomously, directly satisfying the requirement to block signature-based threats in real time. As highlighted in the community breakdown, this proactive stance ensures continuous protection without waiting for human intervention.

Why the Other Options Are Wrong

Monitor mode (A) operates out-of-band by mirroring traffic to a management console, generating alerts but never interfering with the actual data stream. Sensor (B) and Audit (C) are not recognized IPS operational states; they generally describe logging phases or passive data collection where enforcement is disabled. Selecting these options typically stems from a misunderstanding of the fundamental difference between intrusion detection (visibility) and intrusion prevention (action).

Community Comment Notes

Contributors consistently emphasize the real-time blocking capability of active mode, noting its necessity for immediate threat mitigation [1]. One explanation clarifies that the decision hinges on whether the system intervenes during an ongoing attack, confirming active as the only inline option [2]. Additional feedback reinforces that active mode aligns with industry-standard terminology for deployment scenarios requiring automated packet dropping [3].

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When answering IPS/IDS questions, first determine if the scenario demands passive visibility or active intervention. If automatic blocking, packet dropping, or connection resetting is required, active mode is always the correct selection. Memorizing the inline versus out-of-band deployment models will help you rapidly eliminate non-blocking distractors.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. a4e15bd 👍 5
    D. Active In active mode, an intrusion prevention system not only monitors network traffic for suspicious activity but also take immediate action to block or mitigate detected threats based on its signatures. This proactive approach ensures that identified threats are automatically blocked or neutralized providing a real-time protection for the environment.
  2. deejay2 👍 1 Answered D
    It's either active or passive. If it's a current attack (real time), which it appears to be, the answer is active.
  3. 45bfb97 👍 1 Answered D
    Active

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide