Explanation/Reference:
Section: Considerations for Expanding an Existing Network Explanation
Explanation:
A Cisco Intrusion Prevention System (IPS) device sits in line with the network traffic flow; as a result, it can block malicious traffic before the traffic enters the network. When an IPS device detects malicious traffic, it can perform the following actions:
Send an alarm to a management device

Send a TCP reset to the attacking device

Drop packets

Block all packets from the source IP address

Block only the packets associated with the traffic flow based on source IP address, source port,

destination IP address, destination port, and Open Systems Interconnection (OSI) Layer 4 protocol By contrast, a Cisco Intrusion Detection System (IDS) device can detect an attack but it cannot block the packets. IDS devices use a single, promiscuous interface to monitor traffic and do not sit in line with the traffic flow; as a result, they cannot block malicious traffic before it enters the network. When an IDS device detects malicious traffic, it can perform the following actions:
Send an alarm to a management device

Send a Transmission Control Protocol (TCP) reset to the attacking device

Alert devices that sit in line with the traffic flow so that they can block the malicious traffic

Reference:
CCDA 200-310 Official Cert Guide, Chapter 13, IPS/IDS Fundamentals, pp. 534-535 Cisco: Managed Security Services Partnering for Network Security: Managed Intrusion Detection and Prevention Systems