Which of the following statements best describes how IP logging should be used?
A.
be used to automatically correlate events with Cisco Security MARS for incident investigations
B.
only be used when you are also using inline IPS mode
C.
always be enabled since it uses a FIFO buffer on the Cisco IPS Sensor flash memory
D.
only be used temporarily for such purposes as attack confirmation, damage assessment, or the
collection of forensic evidence, because of its impact on performance
E.
be used sparingly because there is a 4-GB limit on the amount of data that can be logged