Which type of control best describes an IPS dropping a malicious packet?