Advanced IDS Concepts GCIA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst notices that an IDS sensor is generating a high volume of alerts for a legitimate internal application that performs large database exports between two servers. The analyst has verified the traffic is benign and wants to reduce noise while still detecting genuine threats from the same source IP. Which approach best addresses this situation?

   • ADisable the IDS rule that triggers on the database export traffic to eliminate all alerts from that rule.
   • BAdd the source IP to the IDS ignore list to prevent any alerts from that host.
   • CCreate a threshold-based suppression rule that suppresses alerts for the specific source-destination pair during the application's known maintenance window.
   • DIncrease the sensor's global alert threshold so fewer alerts are generated across all traffic.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization's IDS is missing attacks that use overlapping fragments. The analyst wants to ensure the sensor can detect these attacks. What is the best configuration change?

   • ASet the sensor to alert on all fragmented traffic.
   • BEnable fragment reassembly and set the reassembly policy to match the target OS.
   • CDisable fragment reassembly to speed up processing.
   • DIncrease the fragment timeout to keep fragments longer.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team has deployed a new IDS and is receiving thousands of alerts daily, most of which are false positives from internal monitoring tools. The team has limited staff and needs to prioritize their investigation efforts. Which approach is most effective for managing this alert volume?

   • AImplement alert correlation rules that group related alerts into incidents based on source IP, destination IP, and time window.
   • BIncrease the severity level of all alerts so that only high-severity alerts are displayed in the console.
   • CAssign each alert to a different analyst randomly to distribute the workload evenly.
   • DTurn off the IDS during business hours when most false positives occur.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team has an IDS that generates a high volume of alerts. After tuning, they have reduced false positives but are now concerned about missing true positives. The team has limited analyst resources and needs to balance detection coverage with the ability to investigate alerts. Which approach best achieves this balance?

   • AImplement a risk-based alert scoring system that prioritizes alerts based on asset criticality and exploitability.
   • BIncrease the IDS sensitivity to catch all potential threats, regardless of the alert volume.
   • CSet the IDS to automatically block all traffic that triggers an alert.
   • DDisable all low-severity alerts to reduce the number of alerts analysts need to review.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst is reviewing IDS alerts and finds that an attacker is sending fragmented IP packets that, when reassembled, form a malicious payload. The IDS is configured to inspect only the first fragment of each packet. What is the most effective way to improve detection of this evasion technique?

   • ASet the IDS to drop all fragmented packets at the network perimeter.
   • BEnable a rule that flags any fragmented traffic as malicious.
   • CConfigure the IDS to perform full packet reassembly before inspecting the payload.
   • DIncrease the fragment reassembly timeout to allow more time for fragments to arrive.
   Reveal Solution Discussion Select an answer first