Which statement correctly distinguishes active defense measures from passive defense measures, and which examples illustrate each?

• A. Active defense reduces risk by design (segmentation, encryption); passive defense detects and disrupts attackers (IPS, deception technologies)
• B. Active defense is only for military; passive is for civilians
• C. Active defense includes backups; passive defense includes IDS
• D. Passive defense seeks to detect and disrupt attackers; active defense reduces risk by design

Answer: (A)

Active defense is about reducing risk by design, embedding protections into how a system is built so that even if an attacker breaches outer layers, the impact is limited. Segmentation isolates parts of the network to halt movement, and encryption protects data so it remains unreadable even if accessed. Passive defense, by contrast, focuses on seeing and slowing or stopping attackers as they try to operate—using measures that monitor and respond to activity, such as intrusion prevention systems that can block malicious traffic and deception technologies that mislead and slow down attackers.

This pairing fits the idea that proactive, architectural protections aim to minimize risk up front, while detection and disruption measures respond to attacker activity. Other statements stray from that distinction: backups are about recovering from incidents after the fact rather than reducing risk by design, and IDS is a detection tool rather than a primary active defense control. The notion that active defense is for military use or that passive defense is the one that disrupts attackers also misaligns with how these concepts are applied in modern security.