How do you stop a hacker from breaking into your company's private network before they even get through the door? This is the problem an Intrusion Prevention System (IPS) solves. For the 350-701 exam, you must understand that an IPS is an active security control sitting inline on the network path, analysing traffic in real time and automatically blocking malicious activity, unlike a Detection system which only generates an alert.
Jump to a section
A simple way to picture Intrusion Prevention Systems (IPS)
A nightclub's front door is the only way in or out for patrons.
This bouncer does not just stand around. He checks every single person who tries to enter against a list of known troublemakers (a signature database). If someone on the list attempts to walk past, the bouncer stops them at the door and turns them away, blocking the threat before it sets foot inside.
But the bouncer also watches behaviour. A well-dressed man is not on the list, but he is aggressively pushing through the crowd, shouting, and trying to bypass the rope. The bouncer spots this suspicious anomaly (behavioural analysis) and intervenes, refusing entry even though the man's name is not on the list.
Crucially, this bouncer does not just report incidents to security afterwards. He acts in real time. He is an active prevention system, not a passive observer. If a fight breaks out inside, he did his job wrong. His job is to ensure the fight never starts inside the venue. This is the precise difference between an Intrusion Prevention System (IPS) and a simple Intrusion Detection System (IDS). The bouncer is the IPS, taking immediate action to stop the threat, whereas a security camera (IDS) would merely record the fight for later review.
An Intrusion Prevention System (IPS) is a security appliance (a dedicated piece of hardware or a virtual machine) that sits directly in the path of network traffic and actively blocks threats.
To understand why we need an IPS, imagine a simple firewall. A firewall is like a basic gatekeeper that checks ID cards (IP addresses and port numbers). If the card says 'allowed', the traffic passes. But a firewall does not care what the traffic actually says. A hacker can send a malicious email through an allowed port (like port 25 for email) and the firewall will let it through because the destination port is correct.
This is where the IPS comes in. The IPS goes one step further. It looks inside the traffic (deep packet inspection - DPI) to see the actual content of the data. It asks, 'Is this email attachment actually a bomb in disguise?'
The IPS works by using a combination of detection methods. The most common is signature-based detection. Think of a signature as a fingerprint. Every known attack has a unique pattern, or signature. The IPS vendor (like Cisco, Palo Alto, or Fortinet) maintains a constantly updated database of these signatures. When traffic matches a signature, the IPS takes action.
But attackers are clever. They change their fingerprints slightly to avoid detection. So an IPS also uses anomaly-based detection. This creates a baseline of 'normal' traffic on the network. What is normal for your company? Maybe employees send 100 emails per minute. Suddenly, one workstation sends 10,000 emails in one minute. That is an anomaly. The IPS flags it and can block it because it looks like a spam bot or a data exfiltration attempt.
There is also policy-based detection. An administrator can write a rule saying 'No ICMP (ping) traffic is allowed from the guest Wi-Fi to the finance server'. The IPS enforces that rule regardless of signatures.
When a threat is detected, the IPS can perform several actions. The most common are:
Drop: The IPS silently discards the malicious packet. The attacker sees nothing in response.
Block: The IPS blocks all future traffic from that source IP address for a set period.
Reset: The IPS sends a TCP reset signal to both the client and server to tear down the connection immediately.
Alert: The IPS logs the event and sends a notification to the security team, but allows the traffic to pass (this is typically used for low-risk events).
Shun: A more aggressive permanent block, often applied automatically or manually by an administrator.
An IPS is always deployed inline. This means it is physically or logically in the path between the traffic source and destination. If the IPS fails (a power outage or hardware crash), traffic stops flowing (fail-close mode). This is a deliberate design choice. It is safer to lose connectivity and alert an administrator than to let malicious traffic flow through an unmonitored device.
The predecessor to IPS was the Intrusion Detection System (IDS). An IDS is a passive monitor. It gets a copy of the traffic (like a network tap) and analyses it. If it finds a threat, it sends an alert. But it cannot stop the attack. By the time the security team reads the alert, the damage is often done. The IPS solves this by stopping the attack in real time.
Why does this matter for 350-701? The exam wants you to know the difference between IPS and IDS inside and out. They will give you a scenario and ask which device should be deployed. If the requirement is 'must block traffic inline in real time', the answer is IPS. If it is 'must monitor and alert only', the answer is IDS.
Traffic Arrival
The IPS receives network traffic from an upstream device, such as a router or firewall. This traffic arrives in packets, each containing headers (source/destination IP, port) and a payload (actual data).
Packet Decoding and Reassembly
The IPS decodes the packet headers and reassembles the data stream. For example, it pieces together fragments of a large file being downloaded. This step ensures the IPS sees the complete picture, not just random bits.
Deep Packet Inspection (DPI)
The IPS examines the payload content, not just the headers. It looks for known attack patterns (signatures), such as specific byte sequences in a malicious PDF file or SQL commands in an HTTP request.
Analysis and Decision
The IPS compares the inspected content against its three detection engines: signature database, anomaly baseline, and policy rules. If a match or anomaly is found, the system decides on an action (drop, block, reset, alert, or shun).
Action Execution
The IPS executes the chosen action. For a 'drop' action, the packet is silently discarded. For 'reset', a TCP reset packet is sent to both ends of the connection. The IPS then logs the event for reporting.
Logging and Reporting
The IPS writes a detailed log entry to its internal storage or forwards it to a central management system (e.g., Cisco Firepower Management Center). Analysts use these logs for forensics, compliance audits, and tuning future policies.
Meet Sarah, a network security engineer at a mid-sized financial services firm. It is 2:00 PM on a Tuesday, and she is sipping lukewarm coffee while staring at her Cisco Firepower Management Center dashboard.
Suddenly, an alert pops up. The IPS has detected an attempted SQL injection attack on the company's customer-facing web application. SQL injection is when an attacker types malicious database commands into a web form to try to steal or destroy data.
Here is what happens step by step:
The attacker, sitting at a cafe, opens his browser and visits Sarah's company website. He finds the login form. Instead of typing 'username', he types a string of SQL commands designed to trick the database.
This malicious request travels across the internet and arrives at the company's perimeter firewall. The firewall sees a normal HTTP request on port 443 (HTTPS). It allows it through.
The request then hits the IPS appliance, which is deployed directly behind the firewall. The IPS performs deep packet inspection. It sees the HTTP request, decrypts it (because it has the decryption certificate installed), and inspects the payload.
The IPS matches the SQL commands against its signature database. There is a signature for 'SQL Injection - Classic WHERE Clause Attempt'. It is a match.
The IPS immediately drops the malicious packet. It also resets the TCP connection between the attacker and the web server. The attacker's browser shows a 'Connection Reset' error.
The IPS logs the event. Sarah sees the alert. She investigates the source IP. It is an unknown external address. She creates a block rule to permanently shun that IP address for 24 hours.
What does Sarah actually do with the IPS day to day? She does not just let it run. She actively manages it. - She tunes the signatures. Out of the box, an IPS can be very noisy, generating thousands of false positives (alerts about normal traffic that looks like an attack). Sarah must disable or lower the severity of signatures for legitimate internal applications. For example, an internal vulnerability scanner might trigger an 'Attack' signature because it is deliberately sending malicious payloads. Sarah creates an exception rule for that scanner's IP. - She updates the signature database. She schedules automatic updates from Cisco Talos to ensure the IPS knows about the latest threats. - She reviews the log files weekly. She looks for patterns. Are there scans from a specific country? Is there a repeated attempt on a legacy application? She adjusts firewall rules and IPS policies accordingly. - She creates custom rules for specific business needs. The finance department uses a legacy application that communicates over a non-standard port. Sarah writes a custom IPS rule that whitelists that traffic, preventing false positives.
The outcome? The company has experienced zero successful intrusions via the web application in the last two years. The IPS does the heavy lifting of stopping automated attacks, freeing Sarah to focus on manual investigations and policy tuning.
The 350-701 exam (SCOR) loves to test your understanding of Intrusion Prevention Systems through specific, often tricky, multiple-choice questions. Here is what you must know cold.
First, you must memorise the difference between IPS and IDS. This is the most common test point. A typical question: 'A security engineer needs to deploy a system that can stop an attack in real time by dropping packets. Which technology should they choose?' The answer is always IPS. The exam will give you a scenario where the requirement is 'must alert but not affect traffic flow' and the answer is IDS. They will also test fail-open versus fail-close. An IPS is fail-close (if it breaks, traffic stops). An IDS is fail-open (if it breaks, traffic continues).
Second, the exam tests deployment modes. An IPS runs in inline mode. An IDS runs in promiscuous (or passive) mode. They may give you a diagram showing a device sitting between the switch and the firewall (inline = IPS) versus a device connected to a SPAN port (passive = IDS).
Third, they test detection methods. - Signature-based: Matches known patterns. Pros? Low false positives for known attacks. Cons? Cannot detect zero-day attacks (new attacks with no signature). - Anomaly-based: Compares traffic to a baseline. Pros? Can detect unknown attacks. Cons? High false positives because normal traffic often deviates from baseline. - Policy-based: Enforces admin-defined rules. Pros? Very specific. Cons? Requires manual effort to maintain.
Fourth, the exam tests the actions an IPS can take. Drop, Block, Reset, Alert, Shun. They will ask: 'Which action silently discards a packet without sending any response to the source?' Answer: Drop. Or: 'Which action prevents all future traffic from a source for a set time?' Answer: Block.
Fifth, they test the concept of false positives and false negatives. - False positive: The IPS triggers an alert for normal traffic (a false alarm). This wastes analyst time. - False negative: The IPS misses a real attack. This is the most dangerous outcome.
The exam asks: 'An analyst notices the IPS is generating too many alerts for legitimate user traffic. What is the most likely cause?' Answer: The signatures are not properly tuned, or the anomaly baseline is not set correctly.
Sixth, they test the distinction between inline and tap mode. Inline means the traffic passes through the device. Tap mode (or SPAN port) means the device gets a copy of the traffic. Only inline mode (IPS) can block. Only tap mode (IDS) can monitor without risk of disrupting traffic.
Finally, the exam may test components. Know that Cisco's IPS solution is often part of the Firepower Next-Generation Firewall (NGFW) or a dedicated appliance. They might reference Cisco Talos as the threat intelligence feed that updates IPS signatures.
An Intrusion Prevention System (IPS) sits inline on the network path and actively blocks malicious traffic in real time.
The primary difference between IPS and IDS is that IPS blocks traffic while IDS only alerts on it.
IPS uses three main detection methods: signature-based, anomaly-based, and policy-based.
If an IPS fails, it defaults to fail-close mode, meaning traffic stops to prevent unmonitored access.
False positives are alerts for legitimate traffic, while false negatives occur when a real attack is missed.
An IPS requires ongoing tuning and signature updates to remain effective against evolving threats.
Cisco's IPS solutions are integrated into the Firepower Next-Generation Firewall and rely on Cisco Talos for threat intelligence.
These come up on the exam all the time. Here's how to tell them apart.
Intrusion Prevention System (IPS)
Sits inline on the network path, traffic flows through it.
Can actively block or drop malicious traffic automatically.
Uses fail-close mode: if it breaks, traffic stops.
Best for environments requiring real-time threat prevention.
Intrusion Detection System (IDS)
Sits passively (uses a SPAN port or tap), receives a copy of traffic.
Can only generate alerts and log events, not block traffic.
Uses fail-open mode: if it breaks, traffic continues unaffected.
Best for monitoring and forensic analysis without risk of disrupting traffic.
Cannot block attacks in real time.
Signature-based Detection
Compares traffic against a database of known attack fingerprints.
Very low false positive rate for known attacks.
Cannot detect new, unknown (zero-day) attacks without an updated signature.
Anomaly-based Detection
Establishes a baseline of normal traffic and flags deviations.
Can detect novel attacks that have no known signature.
High false positive rate because legitimate traffic often deviates from baseline.
IPS Fail-Close Mode
If the hardware fails, all traffic through the IPS is stopped.
Ensures no traffic passes without inspection (security-first).
Can cause a network outage event if the IPS fails.
IPS Fail-Open Mode
If the hardware fails, traffic is allowed to bypass the IPS.
Prioritises network availability over security.
Risks allowing malicious traffic through during the failure.
Drop Action
Silently discards the malicious packet.
No response is sent to the source, so the attacker receives no feedback.
Used when you want to avoid tipping off an attacker.
Reset Action
Sends a TCP reset packet to both the client and server.
Actively tears down the connection, not just a single packet.
Used when you want to ensure the entire session is terminated.
Inline Deployment (IPS)
Device is physically placed between the source and destination.
Can modify or drop traffic because it is in the path.
Single point of failure for network connectivity.
Promiscuous / Tap Deployment (IDS)
Device is connected to a port mirror (SPAN) or network tap.
Cannot modify traffic; only receives a copy.
Does not affect network connectivity if it fails.
False Positive
The IPS generates an alert for traffic that is actually legitimate.
Wastes analyst time investigating non-threats.
Common cause: overly sensitive signatures or incorrect anomaly baseline.
False Negative
The IPS fails to detect a genuine attack.
The attack proceeds unnoticed and can cause damage.
Common cause: missing signature, unknown attack type, or traffic that bypasses inspection.
Mistake
An IPS is the same as a firewall, just a different brand name.
Correct
A firewall makes decisions based on IP addresses and ports (Layer 3-4). An IPS inspects the actual content of the traffic (Layer 7 payload) to look for malicious code. A firewall is like a receptionist checking IDs. An IPS is a security guard who opens your bag and checks the contents.
Many beginners see both as 'security boxes at the network edge' and assume they do the same job, but they operate at completely different layers of the OSI model.
Mistake
If an IPS generates an alert, it means I am being attacked and should panic.
Correct
An IPS generates alerts for many reasons, including false positives (normal traffic that looks like an attack). An alert is a signal for investigation, not confirmation of a breach. Proper tuning drastically reduces false positives, but they still occur.
Beginners equate 'alert' with 'compromise' because that is how alarms work in everyday life (a fire alarm means fire). In networking, IPS alerts are probabilistic, not deterministic.
Mistake
An IPS can replace the need for a security team because it blocks threats automatically.
Correct
An IPS is a tool that automates blocking of known threats, but it still requires human oversight to tune signatures, investigate anomalies, update policies, and respond to advanced attacks that bypass the IPS (false negatives). It reduces workload but does not eliminate the need for skilled analysts.
Vendor marketing often overstates the 'set-it-and-forget-it' capabilities of IPS. Beginners underestimate the operational maintenance required.
Mistake
Deploying an IPS is always better than deploying an IDS.
Correct
An IDS is better in some situations, such as when you cannot risk disrupting traffic (e.g., on a critical legacy system) or when you only need compliance monitoring. An IDS is also useful for forensic analysis because it records all traffic without altering it.
Beginners think 'blocking is always better than alerting', but that ignores the risk of false positives causing business downtime. The choice depends on the specific requirement.
Mistake
An IPS can read encrypted traffic, so SSL/TLS is no protection.
Correct
An IPS cannot inspect encrypted traffic unless it is configured to perform SSL/TLS decryption (which requires installing a certificate on client devices). Without decryption, the IPS only sees encrypted gibberish and will miss attacks inside HTTPS traffic.
Beginners assume security appliances have magical 'see-through' capabilities. In reality, encryption is a major blind spot for IPS unless explicitly configured for decryption.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
An IPS (Intrusion Prevention System) sits inline and actively blocks malicious traffic in real time. An IDS (Intrusion Detection System) receives a copy of traffic passively and only generates alerts, without stopping the attack.
Only if you configure SSL/TLS decryption, which requires installing a trusted certificate on client devices. Without decryption, the IPS only sees encrypted data and cannot inspect the payload.
Most IPS appliances are configured in fail-close mode. If the device fails, traffic stops flowing through it entirely. This prevents unmonitored traffic from passing, but it also causes a network outage until the device is repaired.
Investigate the source and destination of the traffic. If the traffic originated from a trusted internal system running legitimate software (like a vulnerability scanner), it is likely a false positive. You can then create an exception rule to suppress similar alerts.
Yes. A firewall controls access based on IP addresses and ports. An IPS inspects the content inside allowed connections. They complement each other. Many modern Next-Generation Firewalls (NGFWs) include integrated IPS functionality.
Signature-based detection compares network traffic against a database of known attack patterns (signatures). If traffic matches a signature, the IPS takes action. It is effective against known attacks but cannot detect new, unknown (zero-day) attacks.
You've finished Intrusion Prevention Systems (IPS). Continue through the 350-701 study guide to build a complete picture of the exam.
Done with this chapter?