Which two statements are true with respect to IPS false negatives? (Choose two.)

A.
A false negative is the failure of the IPS to create an alert on malicious activity.

B.
Increasing event count thresholds can lead to false negatives.

C.
A false negative results in an IPS alert that is associated with an unsuccessful denial of service attack.

D.
Disabling anti-evasion features of the IPS can reduce false negatives.

E.
False negatives can only occur when an IPS sensor is in promiscuous mode.

Explanation:
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper0 900aecd805c389a.html