Which of the following statements best describes how IP logging should be used?
A.
be used to automatically correlate events with Cisco Security MARS for incident investigations
B.
only be used when you are also using inline IPS mode “Pass Any Exam. Any Time.” – www. 22
Cisco 642-533: Practice Exam
C.
always be enabled since it uses a FIFO buffer on the Cisco IPS Sensor flash memory
D.
only be used temporarily for such purposes as attack confirmation, damage assessment, or the collection of forensic evidence, because of its impact on performance
E.
be used sparingly because there is a 4-GB limit on the amount of data that can be logged