When does the Cisco ASA send traffic to the Cisco ASA IPS module for analysis?

When does the Cisco ASA send traffic to the Cisco ASA IPS module for analysis?
A. before firewall policy are applied
B. after outgoing VPN traffic is encrypted
C. after firewall policies are applied
D. before incoming VPN traffic is decrypted.