A company has recently implemented a hybrid cloud deployment. The security team has been notified about thousands of failed attempts to connect to…

An Intrusion Prevention System (IPS) is the most suitable solution for this scenario. An IPS actively monitors network traffic for malicious patterns, such as brute-force attacks. It can be configured with rules to detect a specific number of failed login attempts (e.g., three) from a single source within a defined period. Upon detecting this pattern, the IPS can automatically take preventive action, such as blocking the offending IP address from making any further connections to the network devices, thereby fulfilling the stated requirement.

A. Data loss prevention: DLP systems are designed to identify, monitor, and protect sensitive data from unauthorized exfiltration; they do not monitor or block login attempts.

B. Firewall: A traditional stateful firewall filters traffic based on IP addresses and ports but typically lacks the application-layer intelligence to count failed login attempts and dynamically block the source.

D. File integrity monitoring: FIM tools are used to detect unauthorized changes to critical system or application files, not to monitor or prevent network-based attacks like brute-force login attempts.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS):

Section 2.1.2, "Prevention Capabilities," states that a key feature of an IPS is its ability to block attacks. It specifies that an IDPS can "block the activity by... blocking access to the target from the offending user account, IP address, or other attacker attribute." This directly supports the IPS's ability to block an IP after detecting malicious login attempts.

2. Palo Alto Networks, What Is an Intrusion Prevention System (IPS)? (Official Vendor Documentation):

Under the section "How Does an Intrusion Prevention System (IPS) Work?", the document explains that an IPS can detect and prevent a variety of threats, including brute-force attacks. It notes that an IPS can "block offending IP addresses" as a response action, which aligns perfectly with the scenario's requirement.

3. Carnegie Mellon University, Software Engineering Institute, Defining Intrusion Detection Systems:

This document distinguishes between Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS). It clarifies that an IPS "is placed in-line and is able to actively prevent/block intrusions that are detected." It further explains that IPS can stop attacks like brute force by identifying the pattern and blocking the traffic source.