Advanced IDS Concepts GCIA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An analyst is configuring an IDS to detect a known exploit that uses a specific string in the payload. The exploit can be obfuscated using different encoding schemes. The analyst wants to detect all variants without generating excessive false positives. Which approach is most effective?

   • AIncrease the alert threshold to reduce false positives.
   • BUse a signature that matches the raw string only.
   • CEnable payload normalization and use a regular expression that matches the decoded content.
   • DWrite a signature for each possible encoding scheme.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst notices that an attacker is using Unicode encoding to obfuscate a URL that matches an IDS signature. The signature does not fire because the encoded URL is not recognized. What is the best way to improve detection?

   • AUse a different IDS vendor.
   • BDisable the signature because it is not working.
   • CIncrease the signature's alert threshold.
   • DEnable normalization of the URL before signature matching.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst is correlating IDS alerts with firewall logs and notices that a single host is triggering the same signature repeatedly against multiple internal servers. The analyst wants to determine whether this is a coordinated scan or a false positive. Which action is most appropriate?

   • AIncrease the alert threshold so only the first alert is reported.
   • BCheck whether the destination ports and payloads vary across the alerts.
   • CDisable the signature to reduce alert fatigue.
   • DBlock the source IP at the firewall immediately.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization has multiple IDS sensors deployed across different network segments. The analyst wants to reduce duplicate alerts and identify multi-stage attacks that span segments. Which approach is most effective?

   • AConfigure each sensor to send alerts to a central correlation engine.
   • BDisable signatures that are common to all sensors.
   • CIncrease the alert threshold on each sensor independently.
   • DDeploy a separate management console for each sensor.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An analyst is correlating IDS alerts with vulnerability scan data. The analyst notices that a critical vulnerability is present on a host that is generating alerts. The analyst wants to prioritize the investigation. Which approach is most effective?

   • AInvestigate alerts in the order they were received.
   • BDisable alerts for hosts with known vulnerabilities.
   • CIgnore alerts for hosts that have not been scanned recently.
   • DPrioritize alerts that match known vulnerabilities on the target host.
   Reveal Solution Discussion Select an answer first