Which IPS Mode Blocks Signature-Based Attacks?
A security engineer is installing an IPS to block signature-based attacks in the environment. Which of the following modes will best accomplish this task?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests the distinction between detection-only and prevention-capable IPS deployments, with the common trap being confusion between monitoring modes that merely log traffic versus those that enforce inline blocking.
This question evaluates your understanding of Intrusion Prevention System (IPS) operational modes and their real-time threat mitigation capabilities. The community unanimously agrees that active mode is the only configuration that automatically blocks known attack signatures.
Monitor (A) is frequently selected by candidates who conflate IDS and IPS functionalities, overlooking that monitor mode only copies traffic for analysis and alerts administrators without disrupting malicious flows.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Active mode is the correct choice because it places the IPS inline with network traffic, enabling it to inspect packets and immediately drop malicious payloads or reset connections when known signatures are matched. Unlike passive systems, this configuration enforces security policies autonomously, directly satisfying the requirement to block signature-based threats in real time. As highlighted in the community breakdown, this proactive stance ensures continuous protection without waiting for human intervention.Why the Other Options Are Wrong
Monitor mode (A) operates out-of-band by mirroring traffic to a management console, generating alerts but never interfering with the actual data stream. Sensor (B) and Audit (C) are not recognized IPS operational states; they generally describe logging phases or passive data collection where enforcement is disabled. Selecting these options typically stems from a misunderstanding of the fundamental difference between intrusion detection (visibility) and intrusion prevention (action).Community Comment Notes
Contributors consistently emphasize the real-time blocking capability of active mode, noting its necessity for immediate threat mitigation [1]. One explanation clarifies that the decision hinges on whether the system intervenes during an ongoing attack, confirming active as the only inline option [2]. Additional feedback reinforces that active mode aligns with industry-standard terminology for deployment scenarios requiring automated packet dropping [3].Official Reference
- https://www.nist.gov/publications/guide-intrusion-detection-and-prevention-systems-idps
- https://help.sophos.com/securityproducts/threatprotection/hc/en-us/articles/1278388463389943-Intrusion-Prevention-System-IPS-modes
- CompTIA Security+ SY0-701 Official Objectives: Domain 2.0 Network Security
Exam Strategy
When answering IPS/IDS questions, first determine if the scenario demands passive visibility or active intervention. If automatic blocking, packet dropping, or connection resetting is required, active mode is always the correct selection. Memorizing the inline versus out-of-band deployment models will help you rapidly eliminate non-blocking distractors.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →