Cisco Cyber Security Practice Exam

Which of the following is NOT a primary function of an IPS?

1. Quarantine infected systems

2. Log network traffic

3. Monitor user activities

4. Detect and respond to threats

The correct answer is: Monitor user activities

An Intrusion Prevention System (IPS) is primarily focused on the detection and prevention of intrusion attempts in a network environment. Among its core functions are detecting and responding to threats, logging network traffic for analysis, and, in some contexts, taking action to quarantine infected systems to prevent further infection. Monitoring user activities, while it may be an aspect of broader security practices, is not a primary function of an IPS. This task typically falls under user behavior analytics or other systems focused on monitoring user actions for compliance or suspicious activity, rather than being a direct responsibility of an IPS. An IPS's main goals are around threat detection and immediate response to potential intrusions rather than detailed user activity monitoring.