Which option correctly describes an IDS/IPS in network defense?

• A. Firewall policies control network access.
• B. Router ACLs filter traffic based on IP addresses.
• C. VPN gateway encrypts user connections.
• D. IDS/IPS systems detect anomalies and can alert or block traffic.

Answer: (D)

IDS/IPS are security controls that monitor network traffic to detect malicious activity. They analyze packets for known attack signatures and for unusual patterns (anomaly detection) and can either raise alerts for administrators or take action to stop the threat. An IDS is typically passive, alerting on findings, while an IPS sits inline and can automatically block or drop offending traffic in real time. This capability to detect and, if needed, block traffic is what defines IDS/IPS in network defense. In contrast, firewall policies manage access control, router ACLs filter traffic based on IP addresses, and a VPN gateway focuses on encrypting connections.