Which three statements about the Cisco IPS appliance anomaly detection feature are true? (Choose three.)
A.
The scanner threshold is used to detect a single scanner.
B.
Once the multiple scanners alert is triggered, the learning period will begin.
C.
The histogram is used to detect multiple scanners.
D.
Once a scanner threshold is violated, an alert is triggered for the multiple scanner signature.
E.
The illegal zone should contain non-allocated internal IP addresses.
F.
The traffic anomaly signature engine contains only two anomaly detection signatures (signature ID 13000 and 13001).
Explanation:
http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/securi ty_manager/3.1/user/guide/ipsvchap.html
And
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/product_data_sheet 0900aecd805baef2.html
