Refer to the exhibit.

The scanner threshold is set to 120. Which two statements about this histogram are true? (Choose two.)

A.
From a single source you do not expect to see nonestablished connections to more than 120 different destination IP addresses.

B.
From a single source you do not expect to see nonestablished connections to more than 100 different destination IP addresses.

C.
You do not expect to see more than 5 sources generate nonestablished connections to 10 or more different destinations.

D.
You do not expect to see more than 10 sources generate nonestablished connections to 5 or more different destinations.

E.
A scanner threshold of 120 is not a valid value for this histogram.

F.
Scanning attacks will not be triggered, because the scanner threshold is higher than the maximum number of destination IP addresses in the histogram.

G.
Scanning attacks will not be triggered, because the scanner threshold is higher than the maximum number of source IP addresses in the histogram.

Explanation:
http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/securi ty_manager/4.0/user/guide/ipsanom.pdf
Read this topic carefully and you will see the answers better. Two test takers have done B & D and have 100% in troubleshooting so believe this is good.