Which two statements are true with respect to IPS false negatives? (Choose two.)
A.
A false negative is the failure of the IPS to create an alert on malicious activity.
B.
Increasing event count thresholds can lead to false negatives.
C.
A false negative results in an IPS alert that is associated with an unsuccessful denial of service attack.
D.
Disabling anti-evasion features of the IPS can reduce false negatives.
E.
False negatives can only occur when an IPS sensor is in promiscuous mode.
Explanation:
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper0 900aecd805c389a.html