Which tool is commonly used as an intrusion detection system and can function as an intrusion prevention system?

Which tool is commonly used as an intrusion detection system and can function as an intrusion prevention system?

• A. Snort
• B. Whois
• C. SecurityMetrics Mobile
• D. Security vulnerability summary

Answer: (A)

The concept being tested is how intrusion detection and prevention tools operate and the way one tool can switch from monitoring to actively blocking traffic. Snort is a classic example: it’s a signature-based system that analyzes network traffic against a set of rules to identify known attack patterns. When used as an IDS, Snort monitors traffic and generates alerts, logs, or notifications based on those rules. But it can also be deployed inline in the network path so it’s able to take action in real time—dropping, replaying, or modifying packets that match its rules—effectively functioning as an intrusion prevention system. This dual capability is what makes Snort widely used for both detection and prevention. The other options don’t fit this role. Whois is a domain registration lookup service and has nothing to do with monitoring or blocking traffic. SecurityMetrics Mobile is a security assessment/product, not a network IDS/IPS tool. A security vulnerability summary is a report, not an active monitoring or protection tool.

The concept being tested is how intrusion detection and prevention tools operate and the way one tool can switch from monitoring to actively blocking traffic. Snort is a classic example: it’s a signature-based system that analyzes network traffic against a set of rules to identify known attack patterns. When used as an IDS, Snort monitors traffic and generates alerts, logs, or notifications based on those rules. But it can also be deployed inline in the network path so it’s able to take action in real time—dropping, replaying, or modifying packets that match its rules—effectively functioning as an intrusion prevention system. This dual capability is what makes Snort widely used for both detection and prevention.

The other options don’t fit this role. Whois is a domain registration lookup service and has nothing to do with monitoring or blocking traffic. SecurityMetrics Mobile is a security assessment/product, not a network IDS/IPS tool. A security vulnerability summary is a report, not an active monitoring or protection tool.