The IPS must block malicious code.

Configuring the IPS to blocks, drops, and/or quarantine based on local organizational incident handling procedures minimizes the impact of this code on the network.

If the device being reviewed is an IDS, this is not applicable.

Verify the IPS blocks malicious code.

If the IPS does not block malicious code, this is a finding.

Configure the IPS to block malicious code.