ISC2 CC Network Security Practice Question
An organization wants to implement a network security device that can block malicious traffic in real-time and must be placed inline. Which device should be chosen?
⚠ Common exam trap
CC often tests the IDS vs IPS distinction — candidates see 'block malicious traffic' and pick IDS, forgetting that only an inline IPS can actually block; IDS is detect-and-alert only.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Intrusion Prevention System (IPS)
An Intrusion Prevention System (IPS) is deployed inline in the traffic path and can actively block malicious traffic in real time by dropping or resetting malicious packets. Because it sits inline, it can make blocking decisions on live traffic, which is exactly what the requirement specifies. This distinguishes it from detection-only or passive tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Vulnerability scanner
Why it's wrong here
A vulnerability scanner probes hosts for known weaknesses on a schedule; it inspects no live traffic and sits out of band, so it cannot block anything inline. It is tempting because it identifies security weaknesses, and would be correct for periodic assessment and patch prioritisation rather than real-time traffic enforcement.
- ✗
Packet sniffer
Why it's wrong here
A packet sniffer passively captures and inspects copies of traffic; it cannot drop or block frames, and inline placement would itself disrupt forwarding. It is tempting because sniffers do analyse malicious traffic, and would be correct for forensic capture or intrusion detection visibility rather than real-time prevention.
- ✗
Intrusion Detection System (IDS)
Why it's wrong here
An IDS only monitors and alerts on mirrored traffic; it cannot block inline because it lacks a prevention engine and sits out of band. It is tempting because it detects intrusions, and would suit passive monitoring or forensic visibility, but the inline blocking requirement demands an IPS.
- ✓
Intrusion Prevention System (IPS)
Why this is correct
An IPS is inline and can block traffic.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Design
Key term
Terminal Access Controller Access-control System
TACACS+ is a remote authentication protocol that uses three separate servers to verify who you are, what you are allowed to do, and record what you did on network devices.
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.