Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Cisco 350-201 Exam - Topic 9 Question 64 Discussion

Refer to the exhibit.IDS is producing an increased amount of false positive events about brute force attempts on the organization's mail server. How should the Snort rule be modified to improve performance?
C) Set the rule to track the source IP
A) Block list of internal IPs from the rule
B) Change the rule content match to case sensitive
D) Tune the count and seconds threshold of the rule

Cisco 350-201 Exam - Topic 9 Question 64 Discussion

Actual exam question for Cisco's 350-201 exam
Question #: 64
Topic #: 9
[All 350-201 Questions]

Refer to the exhibit.

IDS is producing an increased amount of false positive events about brute force attempts on the organization's mail server. How should the Snort rule be modified to improve performance?

Show Suggested Answer Hide Answer
Suggested Answer: C

by Lashandra at Jan 04, 2023, 01:25 PM

Limited Time Offer

25%

Off

Get Premium 350-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Norah
10 months ago
Wait, are we really getting that many false positives? That’s wild!
upvoted 0 times
...
Stephaine
10 months ago
Changing to case sensitive seems unnecessary to me.
upvoted 0 times
...
Kandis
10 months ago
Not sure about that, wouldn’t blocking internal IPs help too?
upvoted 0 times
...
Stefanie
11 months ago
Definitely agree, that should reduce false positives!
upvoted 0 times
...
Matilda
11 months ago
I think tuning the count and seconds threshold is key.
upvoted 0 times
...
Chauncey
11 months ago
I think tracking the source IP could be useful, but I recall that it might not directly reduce false positives like tuning the count would.
upvoted 0 times
...
Gayla
11 months ago
I feel like changing the rule to case sensitive could help, but I’m not confident it would address the false positives effectively.
upvoted 0 times
...
Glen
11 months ago
I'm not entirely sure, but I think blocking internal IPs might not be the best approach. It could lead to missing actual threats.
upvoted 0 times
...
Cordelia
11 months ago
I remember we discussed tuning thresholds in class, so option D seems like it could help reduce false positives.
upvoted 0 times
...
Ben
11 months ago
Okay, let me see here. I know the UNDROP command is used to restore dropped objects, so I'll need to focus on which of these options can be directly restored using that command.
upvoted 0 times
...
Margart
11 months ago
The remote zoom and focus feature sounds like the way to go. That would let me make adjustments without having to physically access the camera, which would save a lot of time on-site. I'm pretty confident that's the best option here.
upvoted 0 times
...
Dawne
11 months ago
This looks like a tricky question. I'll need to carefully analyze the code and the graph options to determine the correct match.
upvoted 0 times
...
Muriel
1 year ago
Option D sounds like the way to go. I mean, who needs false positives when you can just tune the rule and let the good times roll?
upvoted 0 times
...
Shelia
1 year ago
Option A, huh? Blocking internal IPs? That's like trying to catch a fly with a sledgehammer. Talk about overkill!
upvoted 0 times
Helene
1 year ago
Agreed, that way we can reduce false positives without going overboard.
upvoted 0 times
...
Terina
1 year ago
I think tuning the count and seconds threshold of the rule might be a better approach.
upvoted 0 times
...
Adela
1 year ago
Yeah, blocking internal IPs seems a bit extreme.
upvoted 0 times
...
...
Verda
1 year ago
Option B? Seriously? Making the rule case-sensitive? That's like trying to put out a fire with gasoline.
upvoted 0 times
Alita
1 year ago
D) Tune the count and seconds threshold of the rule
upvoted 0 times
...
Leslie
1 year ago
C) Set the rule to track the source IP
upvoted 0 times
...
Lawana
1 year ago
A) Block list of internal IPs from the rule
upvoted 0 times
...
...
Aide
1 year ago
I'd go with Option C. Tracking the source IP seems like a more targeted approach than just blocking a list of internal IPs.
upvoted 0 times
Val
1 year ago
User4: Tuning the threshold could also help reduce false positives.
upvoted 0 times
...
Merlyn
1 year ago
User3: Blocking internal IPs might cause more issues.
upvoted 0 times
...
Daryl
1 year ago
User2: I agree, tracking the source IP would be more effective.
upvoted 0 times
...
Magda
1 year ago
User1: I think Option C is the best choice.
upvoted 0 times
...
...
Gary
1 year ago
Option D looks like the way to go. Tuning the count and seconds threshold could help filter out those pesky false positives without blocking legitimate traffic.
upvoted 0 times
...
Jerry
1 year ago
I believe setting the rule to track the source IP could also help in improving performance.
upvoted 0 times
...
Eladia
1 year ago
I agree with Tatum, adjusting the threshold might reduce false positives.
upvoted 0 times
...
Tatum
1 year ago
I think we should tune the count and seconds threshold of the rule.
upvoted 0 times
...

Save Cancel