About the description of the file filtering technology in the USG6000, which statement is wrong?

If you set the alarm policy for the SMTP virus file, which of the following options is correct?

Which of the following options does not belong to the security risk of the TCP/IP stack application layer?

The core technology of content security lies in anomaly detection. The idea of defense lies in continuous monitoring and analysis.

IPS is an intelligent intrusion detection and prevention product. It can not only detect the occurrence of intrusion, but also can stop the occurrence and development of intrusion in real time through a certain response method and protect the information system from substantive attack in real time.
Which of the following statement is wrong about the description of IPS?