Intrusion Prevention System (IPS)
IPS detects and blocks suspicious traffic in-line.
Updated: 2026-03-05
Definition
An IPS is placed in-line and can actively block malicious traffic based on signatures, rules, or behavioral patterns.
It’s similar to IDS but adds prevention (blocking) capability.
Key points
- In-line blocking
- May impact performance if poorly sized
- Tuning is critical to avoid blocking legitimate traffic
Common mistakes
- Deploying with default rules and causing outages (false positives).
- Assuming IPS replaces endpoint security (it’s one layer).
Related exams
Related terms
Want to practice this in exam-style questions?
Use the mini tests on each exam page, then continue in the app for offline packs and detailed explanations.
Go to exams