Which device is capable of actively blocking intrusions by inspecting traffic and enforcing security policies?

• A. VPN Concentrator
• B. IDS
• C. Firewall
• D. IPS

Answer: (D)

Active intrusion prevention comes from devices that inspect traffic in real time and enforce security policies by taking automatic action to stop attacks. An intrusion prevention system (IPS) sits in the data path and continuously analyzes packets and flows for known attack patterns, suspicious behavior, or policy violations. When it detects malicious activity, it can drop the offending packets, reset connections, or block the attacking host, enforcing security policies immediately without waiting for human intervention. This proactive, inline blocking is the key capability that defines an IPS.

A VPN concentrator handles secure VPN connections and is not focused on blocking intrusions. An IDS, by contrast, monitors traffic and alerts on potential threats but typically does not block traffic by itself. A firewall does enforce access rules and can block traffic, but its primary role is general traffic control rather than actively inspecting for and blocking intrusions in real-time. The question’s emphasis on real-time inspection and active blocking aligns with an IPS.