Which sensor mode can deny attackers inline?

A.
IPS

B.
fail-close

C.
IDS

D.
fail-open

Explanation:
BD
Deny attacker inline: This action denies packets from the source IP address of the attacker for a configurable
duration of time, after which the deny action can be dynamically removed.
Available only if the sensor is configured as an IPS.
Source: Cisco Official Certification Guide, Table 17-4 Possible Sensor Responses to Detected Attacks , p.465