A 40-site retailer runs guest Wi-Fi and POS traffic through cEdge routers with a Unified Security policy already doing URL filtering. Leadership requires malicious payloads to be blocked automatically at the branch, with alerts visible in SD-WAN Manager, without sending traffic to cloud. Which IPS/IDS choice in the Unified Security policy meets these branch requirements?

The requirements are met by on-router IPS in prevention mode with an updated signature set in the Unified Security policy on branch cEdge devices because prevention inspects inline and drops signature-matching sessions while SD-WAN Manager centralizes alerts and the local database avoids cloud offload, blocking guest Wi-Fi and POS payloads at all 40 branches alongside existing URL filtering. The IDS alert-only monitoring approach fails on enforcement concept because detection only generates events for Manager reporting without inline blocking, letting malicious payloads continue despite visibility. The cloud-enriched branch IPS approach fails on architecture concept because adding cloud reputation or sandbox lookups violates the mandate to keep inspection local though it would block and report. The centrally enforced hub IPS approach fails on placement concept because inspecting only at hubs leaves branch breakout and east-west traffic uninspected and adds tromboning latency, violating the at-the-branch requirement. An exam caveat is to judge by outcome not shared terms like inspection, signatures, or Manager, since IDS versus IPS and local versus cloud versus hub change blocking, locality, and privacy. A practical check is to verify in Manager the policy is on branch templates with current IPS pack set to prevention, test with a benign EICAR-style match in lab, and confirm drops and alarms without cloud connections.