2.15 Recommend Tuning or Adapting Devices and Software Across Rules, Filters, and Policies 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security operations center (SOC) analyst notices that the intrusion detection system (IDS) is generating an unusually high number of alerts for outbound connections to a known file-sharing service. The company's baseline shows that this traffic has historically been minimal. The analyst investigates and finds that a new marketing team has started using the service for legitimate file sharing. What should the analyst recommend?

   • AUpdate the IDS baseline to reflect the new legitimate usage and adjust the alert threshold accordingly.
   • BBlock all outbound traffic to the file-sharing service.
   • CCreate an IDS rule to suppress all alerts for the file-sharing service.
   • DIncrease the severity of alerts for the file-sharing service to ensure visibility.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which activity is part of rule lifecycle management?

   • ADeleting all rules that have not fired in the last month
   • BCreating a new rule to detect a newly discovered malware signature
   • CChanging the device's IP address
   • DUpgrading the device's operating system
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A company decides to allow remote access for a new set of employees after a risk assessment. Which action best reflects policy adjustment?

   • APurchase additional hardware for the VPN concentrator
   • BDisable the VPN concentrator to prevent unauthorized access
   • CUpdate the remote access policy to include the new employee group
   • DIgnore the risk assessment and keep the current policy unchanged
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network administrator notices that the intrusion detection system (IDS) has been generating an unusually high number of alerts for outbound DNS queries to a specific domain. The baseline shows that this domain was rarely queried before. Threat intelligence lists the domain as a potential command-and-control (C2) endpoint. The administrator wants to determine if this is a real threat or a false positive. What should the administrator do first?

   • ACompare the current DNS query patterns to the established baseline and investigate which hosts are making the queries.
   • BImmediately block the domain on the firewall to stop potential C2 traffic.
   • CDisable the DNS alert signature to reduce noise.
   • DIncrease the IDS sensitivity to catch more DNS-related alerts.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of tuning device-specific rule sets in a security monitoring environment?

   • ATo ensure the device is compliant with vendor licensing
   • BTo replace the device's firmware with a newer version
   • CTo increase the number of alerts generated by the device
   • DTo improve detection accuracy by reducing false positives and false negatives
   Reveal Solution Discussion Select an answer first