At a hospital, a sensor receives only a copy of clinical traffic, and powering that sensor off does not stop the clinical traffic. Which deployment matches this result?

A tap or other monitoring copy receives a duplicate. Powering off that device stops the duplicate, and the original clinical packets continue. The stem gives both facts: the sensor gets a copy, and power loss leaves clinical traffic up. "A tap or other traffic-monitoring copy that can go dark without stopping the original packets". A copy can go dark without stopping the original packets, which matches the hospital result. "An inline IPS on the forwarding path, able to interrupt clinical traffic when that device loses power". That deployment is on the forwarding path and would interrupt clinical traffic on power loss. Here power loss left clinical traffic up, and the sensor receives a copy. "A host firewall on each clinical workstation, filtering packets before they leave the computer". A host firewall filters on the workstation before packets leave that computer. The stem is a separate sensor receiving a copy of traffic, not a filter on each clinical host. "A NAT router that rewrites clinical addresses and must stay up for those sessions to continue". Address translation is on the path those translated sessions use. Taking the translator down is not the same as powering off a device that only receives a copy. Exam caveat: do not invent a fail-open or fail-closed default for inline gear from this stem. The evidence given is a copy whose loss leaves the original traffic up. Operational check: in a maintenance window, disconnect only the monitoring feed and confirm clinical sessions stay up while that copy stops.