Which device is designed to prevent attacks before they spread deeper into the network?

• A. Intrusion Prevention System (IPS)
• B. IDS
• C. VPN Gateway
• D. Load Balancer

Answer: (A)

Preventing attacks at the network edge relies on an inline device that can inspect traffic in real time and block malicious activity before it reaches internal resources. An Intrusion Prevention System sits directly in the data path and can drop or reset connections that match known attack patterns or exhibit anomalous behavior, actively stopping exploits from spreading deeper into the network. This active blocking capability is what distinguishes it from other options. An IDS, for example, is a monitoring and alerting tool that observes traffic and notifies administrators or triggers responses—without automatically stopping the traffic. A VPN gateway secures and authenticates remote connections and encrypts data, but its primary role isn’t to block intrusions as they arrive. A load balancer distributes traffic to servers to improve performance and availability, and some security features may be layered on, but it isn’t designed to detect and prevent attacks from entering the network in real time.