While designing a security solution, which three requirements would make you decide to deploy an IPS sensor in inline mode? (Choose three.)

Resilience to sensor failure is an argument for promiscuous mode, not inline mode - an inline sensor that fails becomes a single point of failure that can drop all traffic unless a hardware bypass is configured.

Stream normalization - reassembling fragmented IP packets and normalizing protocol-level anomalies used in evasion attacks - requires the sensor to be physically in the traffic path so it can modify or reconstruct the stream before forwarding, which is only possible in inline mode.

Inline mode adds processing latency because every packet must traverse the sensor before being forwarded, making it incompatible with the requirement to protect voice traffic from added jitter and delay.

Signature-based pattern matching combined with active prevention requires inline placement because the sensor must inspect each packet and drop matching traffic before it reaches the destination, a capability not available when the sensor operates out-of-band.

The ability to deny or drop packets inline is the core differentiator of IPS inline mode over promiscuous IDS mode; the sensor sits in-band in the traffic path and can discard malicious packets in real time before they reach their target.