Which statement best distinguishes an intrusion detection system (IDS) from an intrusion prevention system (IPS)?

• A. IDS blocks threats; IPS only logs alerts.
• B. IPS detects threats and notifies administrators.
• C. IDS and IPS perform identical functions.
• D. IDS detects and alerts; IPS actively blocks or mitigates threats in real time.

Answer: (D)

The main idea here is how the system reacts to threats. An intrusion detection system watches traffic, analyzes it for signs of intrusion, and raises alerts to administrators or a security console. It doesn’t block the traffic by itself. An intrusion prevention system, on the other hand, sits in the path of traffic and can enforce security in real time by blocking or mitigating malicious activity—dropping packets, resetting connections, or otherwise stopping the threat from reaching its target. That real-time enforcement is what sets IPS apart from IDS.

So the best statement is that IDS detects and alerts, while IPS actively blocks or mitigates threats in real time.

Other options mix up roles: one describes blocking as a feature of IDS, which is not correct; another suggests IPS only logs alerts, which misses its active blocking capability; and claiming they are identical ignores the enforcement difference.