By default, how does a Cisco ASA appliance process IP fragments?

A.
Each fragment passes through the Cisco ASA appliance without any inspections.

B.
Each fragment is blocked by the Cisco ASA appliance.

C.
The Cisco ASA appliance verifies each fragment and performs virtual IP re-assembly before the
full IP packet is forwarded out.

D.
The Cisco ASA appliance forwards the packet out as soon as all of the fragments of the packet
have been received.

Explanation:
http://www.cisco.com/en/US/docs/security/asa/asa81/config/guide/intro.html
Protecting from IP Fragments The adaptive security appliance provides IP fragment protection.
This feature performs full reassembly of all ICMP error messages and virtual reassembly of the
remaining IP fragments that are routed through the adaptive security appliance. Fragments that
fail the security check are dropped and logged. Virtual reassembly cannot be disabled.