What is the role of an Intrusion Prevention System (IPS) in a security architecture?

• A. To identify and log security events for later review.
• B. To classify network traffic for monitoring only.
• C. To block potential threats based on detected malicious activity.
• D. To replace firewalls in the network perimeter.

Answer: (C)

An IPS is an in-line security control that detects malicious activity and blocks it in real time. It sits directly in the traffic path and can take immediate action—dropping malicious packets, resetting connections, or blocking offending hosts—based on signatures, behavior, or anomaly detection. This real-time blocking is what makes it different from systems that only observe or log events. The purpose is active defense: prevent exploitation as traffic flows, rather than merely classify or report it. It complements, rather than replaces, firewalls and other controls; while some solutions blend features, the primary role is to actively prevent threats, not just monitor or replace existing perimeter defenses.