CompTIA Cloud+ Practice Test

What do network-based IPS systems do in response to security breaches?

1. Monitor user behavior

2. Take active security breach countermeasures

3. Encrypt data in transit

4. Perform regular audits

The correct answer is: Take active security breach countermeasures

Network-based Intrusion Prevention Systems (IPS) are designed to actively respond to security breaches in real time. When a suspicious activity is detected that may indicate an ongoing attack or breach, these systems can take immediate action to mitigate the threat. This can include blocking malicious traffic, preventing further access to compromised systems, or even terminating sessions that pose a risk. The core functionality of a network-based IPS is its proactive approach to security. Rather than merely logging incidents or monitoring for user behavior, it engages in direct, automated countermeasures against identified threats. This capability is fundamental in reducing the impact of attacks and ensuring the integrity and availability of the network. In contrast, options like monitoring user behavior or performing regular audits are more aligned with passive security measures that may aid in identifying vulnerabilities or ensuring compliance but do not provide the immediate protective response characteristic of an IPS. Encrypting data in transit is also vital for protecting data confidentiality, but it does not directly pertain to responding to security breaches in the manner that IPS systems are designed to do.