Which statement best differentiates intrusion detection and intrusion prevention systems?

• A. Intrusion prevention systems (IPS) block or mitigate detected threats.
• B. Intrusion detection systems (IDS) monitor and alert on suspicious activity.
• C. Both IDS and IPS perform the same function of blocking threats.
• D. IDS is only deployed on networks, not on hosts.

Answer: (B)

The key idea is the difference between detection and prevention. An intrusion detection system watches traffic or system activity, analyzes it for signs of malicious behavior, and alerts you when something suspicious is found. It doesn’t automatically stop the traffic or the attack; it provides visibility so responders can take action.

An intrusion prevention system, on the other hand, sits in line with the traffic and can take automatic steps to stop threats in real time—like dropping malicious packets, resetting connections, or reconfiguring flows to prevent exploitation. That active blocking capability is what sets IPS apart from IDS.

So the statement that describes IDS as monitoring and alerting best captures the distinction: IDS focuses on detecting and notifying, while IPS focuses on blocking or mitigating threats. The other ideas blur the lines by implying blocking is part of IDS or by restricting IDS to networks only, which isn’t accurate.