Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Cisco 350-201 Exam - Topic 5 Question 26 Discussion

Refer to the exhibit.IDS is producing an increased amount of false positive events about brute force attempts on the organization's mail server. How should the Snort rule be modified to improve performance?
B) Change the rule content match to case sensitive
A) Block list of internal IPs from the rule
C) Set the rule to track the source IP
D) Tune the count and seconds threshold of the rule

Cisco 350-201 Exam - Topic 5 Question 26 Discussion

Actual exam question for Cisco's 350-201 exam
Question #: 26
Topic #: 5
[All 350-201 Questions]

Refer to the exhibit.

IDS is producing an increased amount of false positive events about brute force attempts on the organization's mail server. How should the Snort rule be modified to improve performance?

Show Suggested Answer Hide Answer
Suggested Answer: B

by Bulah at May 05, 2022, 01:41 AM

Limited Time Offer

25%

Off

Get Premium 350-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Gaston
10 months ago
Wait, are we really getting false positives from our own mail server? That's wild!
upvoted 0 times
...
Melynda
10 months ago
I disagree, tracking the source IP won't solve the false positive issue.
upvoted 0 times
...
Leontine
11 months ago
Changing the rule to case sensitive could help reduce false positives.
upvoted 0 times
...
Katlyn
11 months ago
Blocking internal IPs seems like a quick fix, but is it really effective?
upvoted 0 times
...
Rodrigo
11 months ago
I think tuning the count and seconds threshold is key!
upvoted 0 times
...
Quentin
11 months ago
Okay, let me see. I think the key here is that the question is asking about a system that guarantees the coherence of information security. That sounds like it's referring to a management or governance framework, not a specific technology. I'll go with A.
upvoted 0 times
...
Gearldine
11 months ago
Ah, I see. Restricting the general journal to only allow ledger-type transactions should work. I'm confident this solution will meet the client's needs.
upvoted 0 times
...
Shonda
11 months ago
Okay, I've got this. A relational database domain is the set of permissible values for an attribute in a table. So it's option B - a set of permissible tuple values. I'm confident that's the right answer.
upvoted 0 times
...

Save Cancel