A regional retailer with 40 stores runs POS traffic and guest Wi-Fi on the same WAN Edge routers, must inspect inbound Internet traffic for exploits, and needs automatic signature updates without a separate appliance. Which IPS/IDS design should you deploy in the Unified Security policy to meet these requirements?
Select an answer to reveal the explanation.
Short Explanation
You've got the right instinct to push inspection to the edge where Internet hits. Inspection-mode IPS actually drops exploits while IDS only watches, like a guard who also locks the door.
Full Explanation
Unified Security policy pushes IPS/IDS inspection to Cisco IOS XE WAN Edge routers, where Snort-based inspection applies downloaded signature sets to traffic matching the security policy, with IPS dropping malicious sessions and IDS only alerting. That mechanism makes IPS inspection on the Internet-facing template with a balanced signature set correct because it protects POS systems from inbound exploits and keeps signatures current through SD-WAN Manager, formerly vManage, updates. IDS monitor-only on the LAN template fails by concept because monitor mode never blocks and LAN scope misses inbound Internet exploits. URL filtering with reputation scoring fails by concept because it controls web categories and reputation, not exploit signatures and buffer-overflow detection. TLS proxy for overlay control traffic fails by concept because TLS proxy targets user web sessions for URL and AMP inspection, not OMP and DTLS/TLS control connections which must remain trusted. Exam caveat is to distinguish IPS drop versus IDS alert and remember inspection happens on the router, not on SD-WAN Controller. Practical check is to verify security license, signature package version, and drop versus alert counters after policy push.