Which IPS alert action is available only in inline mode?
A.
produce verbose alert
B.
request rate limit
C.
reset TCP connection
D.
log attacker/victim pair packets
E.
deny-packet-inline
F.
request block connection
Explanation:
http://www.cisco.com/web/about/security/intelligence/ipsmit.html
Inline Mode Event Actions
The following actions require the device to be deployed in Inline mode and are in affect for a user- configurable default time of 3600 seconds (60 minutes). Deny
attacker inline: This action is the most severe and effectively blocks all communication from the attacking host that passes through the IPS for a specified period oftime. Because this event action is severe, administrators are advised to use this only when the probability of false alarms or spoofing is minimal.
Deny attacker service pair inline: This action prevents communication between the attacker IP address and the protected network on the port in which the event
was detected. However, the attacker would be able to communicate on another port that has hosts on the protected network. This event action works well for
worms that attack many hosts on the same service port. If an attack occurred on the same host but on another port, this communication would be allowed. This
event action is appropriate when the likelihood of a false alarm or spoofing is minimal. Deny attacker victim pair inline: This action prevents the attacker from
communicating with the victim on any port. However, the attacker could communicate with other hosts, making this action better suited for exploits that target a
specific host. This event action is appropriate when the likelihood of a false alarm or spoofing is minimal.
Deny connection inline: This action prevents further communication for the specific TCP flow. This action is appropriate when there is the potential for a false alarm
or spoofing and when an administrator wants to prevent the action but not deny further communication. Deny packet inline: This action prevents the specific
offending packet from reaching its intended destination.
Other communication between the attacker and victim or victim network may still exist. This action is appropriate when there is the potential for a false alarm or
spoofing. Note that for this action, the default time has no effect.
Modify packet inline: This action enables the IPS device to modify the offending part of the packet. However, it forwards the modified packet to the destination. This
action is appropriate for packet normalization and other anomalies, such as TCP segmentation and IP fragmentation re-ordering.