When does the Cisco ASA send traffic to the Cisco ASA IPS module for analysis?

When does the Cisco ASA send traffic to the Cisco ASA IPS module for analysis?

A.
after outgoing VPN traffic is encrypted

B.
after firewall policies are applied

C.
before incoming VPN traffic is decrypted.