Exam 300-710 topic 1 question 51 discussion

I agree with the A&C. I would like to add that in Snort2, Threshold can be applied both per policy and globally, but in Snort3, it can only be applied per policy. https://community.cisco.com/t5/tkb-%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3-%E3%83%89%E3%82%AD%E3%83%A5%E3%83%A1%E3% 83%B3%E3%83%88/intrusion-event-%E7%94%9F%E6%88%90%E3%81%AE%E9%96%BE%E5%80%A4%E5%A4%89%E6%9B%B4%E3%81%AE%E3%81%94%E7%B4%B9%E4%BB%8B /ta-p/4703848

According to real life environment, you can set it on per IPS rules and globally. A & C.

You can set a global threshold across all traffic to limit how often events from a specific source or destination are logged and displayed per specified time period. For more information, see Understanding Thresholding, page 22-1 and Configuring Global Thresholds, page 22-3. • You can set thresholds per shared object rule, standard text rule, or preprocessor rule in your intrusion policy configuration, as described in Configuring Event Thresholding, page 20-21. https://www.cisco.com/c/en/us/td/docs/security/firesight/541/firepower-module-user-guide/asa-firepower-module-user-guide-v541/Intrusion-Global-Threshold.pdf

Integrated Routing and Bridging (IRB) : Customers often want to have multiple physical interfaces configured to be part of the same VLAN. The IRB feature meets this demand by allowing users to configure bridges in routed mode, and enables the devices to perform L2 switching between interfaces (including subinterfaces).