2.15 Recommend Tuning or Adapting Devices and Software Across Rules, Filters, and Policies 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary driver for adjusting security policies in an organization?

   • AThe desire to increase the number of security controls
   • BChanges in organizational risk tolerance and operational requirements
   • CThe requirement to comply with vendor marketing materials
   • DThe need to reduce the cost of security tools
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   A large enterprise has an intrusion prevention system (IPS) deployed inline. The security team is receiving a high volume of false-positive alerts for a signature that detects 'ET POLICY Outbound HTTP with Basic Auth'. The traffic is generated by a legacy application that uses HTTP basic authentication to a known internal server. The application is scheduled to be replaced in 18 months. The security team wants to reduce the alert noise without losing visibility into other potential basic-auth abuse. The compliance team also requires that any rule changes be documented and reviewed. What should the security team do?

   • ACreate an IPS exception for the legacy application's source IP and destination IP pair, and document the change.
   • BMove the legacy application to a separate network segment and apply the signature only to that segment.
   • CIncrease the IPS sensitivity threshold for all signatures to reduce the number of alerts.
   • DDisable the signature globally and document the change.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst notices that the intrusion prevention system (IPS) has been generating a high volume of alerts for a signature that detects SQL injection attempts. After reviewing the traffic, the analyst determines that the alerts are triggered by a legacy application that sends database queries in the URL parameters. The application is scheduled to be decommissioned in six months. What should the analyst recommend to reduce the alert noise while maintaining visibility into real SQL injection attempts?

   • AIncrease the IPS sensitivity threshold for all signatures to reduce the number of alerts.
   • BMove the legacy application to a separate VLAN and apply the SQL injection signature only to that VLAN.
   • CCreate an IPS rule exception for the legacy application's source IP address and keep the signature enabled for all other traffic.
   • DDisable the SQL injection signature globally on the IPS.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   After a phishing incident, a security team reviews the email security gateway logs and finds that the existing rule for blocking executable attachments was bypassed because the attacker used a double extension (e.g., 'invoice.pdf.exe'). The team wants to update the rules to prevent similar attacks. What should they do?

   • ADisable the existing executable attachment rule because it was ineffective.
   • BSend a notification to all users to be careful with attachments.
   • CAdd a rule that blocks all emails with any attachment that has a double extension.
   • DIncrease the spam score threshold to catch more phishing emails.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   A network administrator needs to modify a content filter to allow a new business-critical web application that was recently deployed. Which action best represents adapting filters?

   • ARemove all existing filter rules to avoid conflicts
   • BReboot the filtering device to apply default settings
   • CCreate a new filter rule to permit traffic to the application's domain
   • DIncrease the logging level for all filtered traffic
   Reveal Solution Discussion Select an answer first