What are the two options for handling false-positive events reported by the Cisco Security MARS appliance?

What are the two options for handling false-positive events reported by the Cisco Security MARS appliance? (Choose two.)

A.
archive to NFS only

B.
save as a false-positive report

C.
drop

D.
mitigate at Layer 2

E.
log to the database only

F.
escalate to the Cisco Security MARS administrator