When a virus is detected in an email, which of the following is not the corresponding action for detection?

Due to the differences in network environment and system security policies, intrusion detection systems also differ in their implementation.
In terms of system composition, what are the four major components?

Which of the following statement is wrong about a network intrusion detection system (NIDS)?

When the license of Huawei USG6000 product expires, the RBL function will be unavailable, and users can only use the local black and white list to filter junk mail.

The following is a description of black and white lists in spam filtering. Which option is wrong?