In differentiating IDS and IPS, which statement is correct?

• A. IPS only logs anomalies
• B. IDS blocks threats; IPS only monitors.
• C. IDS monitors and alerts; IPS can actively block.
• D. Both never block

Answer: (C)

The difference being tested is how the systems handle traffic: one is a monitoring and alerting tool, the other sits in line and can actively block traffic. An IDS watches network traffic, analyzes it for suspicious activity, and raises alerts or logs incidents for administrators to respond to. It does not intervene to stop traffic by itself. An IPS, on the other hand, is placed inline on the data path and can automatically block or drop traffic it identifies as malicious, acting in real time to prevent intrusions.

This is why the statement that IDS monitors and alerts while IPS can actively block is the best answer. The other options mischaracterize the roles: an IPS is not limited to logging-only and can block; an IDS does not block traffic; and the idea that neither system blocks traffic is incorrect because the defining feature of an IPS is its ability to block.