Which statement best describes the action of a Network Intrusion Prevention System (NIPS)?

• A. Listens passively and logs events
• B. Inlines the traffic and can block malicious activity
• C. Only monitors host-based traffic
• D. Generates alerts without blocking

Answer: (B)

A Network Intrusion Prevention System is intended to sit in-line on the network path so it can enforce security policies in real time by inspecting traffic and blocking malicious activity as it passes. This real-time blocking capability (dropping or resetting offending traffic) is what sets NIPS apart from passive detectors. The other descriptions describe systems that only monitor or log events, or that operate on hosts rather than the network, or that alert without taking action. Therefore, inline traffic control with the ability to block is the best description.