According to SAFE, what is the expected behavior in a medium, single-site campus module
sensor?
A.
Generally, automatic blocking on this sensor should be avoided.
B.
This sensor detects and analyzes attacks originating from within the campus network as well as
those that get through the WAN module.
C.
The number of alarms that these sensors generate is very high
D.
The traffic that this sensor sees is not dependent upon the corporate security policy.
E.
Review and tune as necessary the signatures specific to vulnerabilities in Web, DNS, FTP, and
mail servers.