A management workstation collects and connects events from multiple IPS sensors in the network. Which protocol is used in this process?

SNMP (Simple Network Management Protocol) is used for general network device monitoring and management, not for retrieving structured security event logs from IPS sensors.

SCCP (Skinny Client Control Protocol) is a Cisco proprietary signaling protocol used for VoIP communications between IP phones and Cisco Unified Communications Manager, and has no role in IPS event collection.

SRTP (Secure Real-time Transport Protocol) is used to encrypt real-time voice and video media streams and is entirely unrelated to IPS sensor event exchange.

SDEE (Security Device Event Exchange) is a request-response protocol developed by Cisco specifically to retrieve security events and alerts from IPS sensors. A central management workstation uses SDEE over HTTPS to poll each sensor and collect event data in a standardized XML format, making it the correct protocol for aggregating IPS alerts across multiple devices.