A financial branch WAN Edge must block known malware callbacks and exploit attempts for Internet-bound traffic without adding appliances. The security team wants automatic signature updates and logging within the existing SD-WAN security workflow. Which IPS/IDS design in Unified Security policy meets inline prevention needs?
Select an answer to reveal the explanation.
Short Explanation
You stop exploits when inspection can actually drop them. Prevention-mode IPS with fresh signatures gives you inline blocking plus clean logs.
Full Explanation
The correct design enables IPS inline in prevention mode within the existing Unified Security policy with automatic signature updates and centralized logging, which directly satisfies the branch requirement to block known malware callbacks and exploit attempts on Internet-bound traffic without adding appliances while staying in the SD-WAN security workflow, since prevention drops or resets matching sessions while current signatures keep coverage effective and logging provides audit and tuning evidence. The detection-mode tuning design fails by concept because IDS-style detection improves visibility and baselining but does not enforce blocking, so callbacks would still egress despite correct scope, updates and logs. The scheduled manual-update design fails by concept because holding signatures to change-controlled reviews improves stability but violates the automatic-update requirement and leaves a gap where new callbacks and exploits pass until the next approval. The east-west inspection design fails by concept because enforcing prevention with updates and logging on inter-branch traffic protects lateral movement but leaves the stated Internet egress path uninspected, so the required threat vector remains open despite correct enforcement mechanics. Exam caveat: evaluate enforcement verb, update mechanism and traffic direction together rather than selecting any plausible IPS statement, since exams often pair correct mechanics with wrong scope or correct scope with wrong enforcement. Practical check: after committing the Unified Security policy confirm the WAN Edge shows the current signature pack version, generates prevention logs for test exploit signatures and increments block counters for Internet-bound rules.