Anomaly detection may send an alert under which two circumstances? (Choose two.)
A.
The attacker obfuscates a malicious HTTP request.
B.
Inbound traffic arrives from a source with a low reputation score.
C.
Outbound traffic is destined towards a known botnet system.
D.
A single worm-infected source enters the network and starts scanning for other vulnerable hosts.
E.
Benign traffic is misinterpreted as an attack.
F.
The network starts becoming congested by worm traffic.
Explanation:
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/anomaly_detector/v5.0/ configuration/guide/Intro.html#wp1046115
The Detector module analyzes the zone traffic, and sends out an alert when a DoS attack is detected. The Detector module can detect attacks and activate
protection mechanisms. It is best suited to work alongside with the Cisco Anomaly Guard Module but it can also operate as a separate DDoS detection and alarm
component.