Cisco Exam 350-201 Topic 9 Question 64 Discussion

Actual exam question for Cisco's 350-201 exam

Question #: 64
Topic #: 9

Refer to the exhibit.

IDS is producing an increased amount of false positive events about brute force attempts on the organization's mail server. How should the Snort rule be modified to improve performance?

ABlock list of internal IPs from the rule

BChange the rule content match to case sensitive

CSet the rule to track the source IP

DTune the count and seconds threshold of the rule

Show Suggested Answer

Suggested Answer: C

by Lashandra at Jan 04, 2023, 01:25 PM

Limited Time Offer

25%

Off

Get Premium 350-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Muriel

1 months ago

Option D sounds like the way to go. I mean, who needs false positives when you can just tune the rule and let the good times roll?

upvoted 0 times

...

Shelia

1 months ago

Option A, huh? Blocking internal IPs? That's like trying to catch a fly with a sledgehammer. Talk about overkill!

upvoted 0 times

Helene

1 days ago

Agreed, that way we can reduce false positives without going overboard.

upvoted 0 times

...

Terina

13 days ago

I think tuning the count and seconds threshold of the rule might be a better approach.

upvoted 0 times

...

Adela

17 days ago

Yeah, blocking internal IPs seems a bit extreme.

upvoted 0 times

...

Verda

2 months ago

Option B? Seriously? Making the rule case-sensitive? That's like trying to put out a fire with gasoline.

upvoted 0 times

Alita

1 months ago

D) Tune the count and seconds threshold of the rule

upvoted 0 times

...

Leslie

1 months ago

C) Set the rule to track the source IP

upvoted 0 times

...

Lawana

2 months ago

A) Block list of internal IPs from the rule

upvoted 0 times

...

Aide

2 months ago

I'd go with Option C. Tracking the source IP seems like a more targeted approach than just blocking a list of internal IPs.

upvoted 0 times

Val

1 months ago

User4: Tuning the threshold could also help reduce false positives.

upvoted 0 times

...

Merlyn

1 months ago

User3: Blocking internal IPs might cause more issues.

upvoted 0 times

...

Daryl

2 months ago

User2: I agree, tracking the source IP would be more effective.

upvoted 0 times

...

Magda

2 months ago

User1: I think Option C is the best choice.

upvoted 0 times

...

Gary

2 months ago

Option D looks like the way to go. Tuning the count and seconds threshold could help filter out those pesky false positives without blocking legitimate traffic.

upvoted 0 times

...