Which three statements about the Cisco IPS appliance anomaly detection feature are true? (Choose three.)

A.
The scanner threshold is used to detect a single scanner.

B.
Once the multiple scanners alert is triggered, the learning period will begin.

C.
The histogram is used to detect multiple scanners.

D.
Once a scanner threshold is violated, an alert is triggered for the multiple scanner signature.

E.
The illegal zone should contain non-allocated internal IP addresses.

F.
The traffic anomaly signature engine contains only two anomaly detection signatures (signature ID 13000 and 13001).

Explanation:
http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/securi ty_manager/3.1/user/guide/ipsvchap.html
And
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/product_data_sheet 0900aecd805baef2.html