Which Cisco Advanced Malware Protection for Endpoints policy is used only for monitoring endpoint actively?

Which Cisco Advanced Malware Protection for Endpoints policy is used only for monitoring endpoint actively?
A. Windows domain controller
B. audit
C. triage
D. protection