Which type of signature engine is best suited for creating custom signatures that inspect data at OSI Layer 5 and above?

A.
Atomic

B.
String

C.
Sweep

D.
Service

E.
Meta

F.
Flood

Explanation:
http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_signature_engines.
html#wp1014328
Service Engines

The Service engines analyze Layer 5+ traffic between two hosts. These are one-to-one signatures that track persistent data. The engines analyze the Layer 5+
payload in a manner similar to the live service.