Which configuration mode enables a virtual sensor to monitor the session state for unidirectional
traffic?

Over the period of one day, several Atomic ARP engine alerts fired on the same IP address. You observe
that each time an alert fired, requests on the IP address exceeded replies by the same number. Which
configuration could cause this behavior?

Which type of signature is generated by copying a default signature and modifying its behavior?

Which two conditions must you configure in an event action override to implement a risk rating of 70 or
higher and terminate the connection on the IPS? (Choose two.)

Which two conditions must you configure in an event action rule to match all IPv4 addresses in the
victim range and filter on the complete subsignature range? (Choose two.)

If learning accept mode is set to “auto” and the knowledge base is loaded only when explicitly requested
on the IPS, which statement about the knowledge base is true?

In which way are packets handled when the IPS internal zone is set to “disabled”?

Which three statements about threat ratings are true? (Choose three.)

An IPS is configured to fail-closed and you observe that all packets are dropped. What is a possible
reason for this behavior?

What can you use to access the Cisco IPS secure command and control channel to make configuration
changes?