You are asked to ensure that traffic that matches an IDP policy is not impacted until administrators have a chance to evaluate it. In this scenario…

The goal is to monitor traffic that matches an Intrusion Detection and Prevention (IDP) policy without affecting the traffic flow, allowing for later evaluation. The ip-notify action is designed for this purpose. When a rule with this action is triggered, IDP generates a log or alert for the event but takes no preventative action against the connection or the source IP address. The traffic is allowed to pass unimpeded, fulfilling the requirement of being non-impactful while providing visibility for administrators.

A. ip-block is an impacting action that blocks all subsequent traffic from the source IP address for a specified duration.

C. ip-connection-rate-limit is an impacting action that throttles the number of connections allowed from a source IP address.

D. ip-close is an impacting action that actively terminates the matching TCP connection by sending reset (RST) packets to both the client and server.

Juniper Networks TechLibrary, "Understanding IDP Policy Rule Actions". This document describes the available actions. For ip-notify, it states, "No action is taken against the IP connection. The device generates logs, if configured to do so."

Juniper Networks TechLibrary, "IDP Rule Actions Overview". This guide explicitly categorizes actions. It lists ip-notify as a notification-only action, while ip-block, ip-close, and others are listed as actions that "act on the IP session."