| Exam 210-260 | Question id=717 | IPS | 
        Which Sourcefire logging action should you choose to record the most detail about a connection?
      
| A. | Enable logging at the end of the session. | |
| B. | Enable logging at the beginning of the session. | |
| C. | Enable alerts via SNMP to log events off-box. | |
| D. | Enable eStreamer to log events off-box. |