Which three statements accurately describe Cisco IPS 6.0 Sensor Anomaly Detection? (Choose
three.)

A.
It sub-divides the network into two zones (internal and external).

B.
In the Anomaly Detection histograms, the number of source IP addresses is either learned or
configured by the user.

C.
It is used to identify worms which spread by scanning the network.

D.
It has three modes: learn mode, detect mode, and attack mode.

E.
Anomaly Detection signatures have three sub-signatures (single scanner, multiple scanners,
and worms outbreak).

F.
In the Anomaly Detection histograms, the number of destination IP addresses is predefined.