Advanced IDS Concepts GCIA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An analyst is investigating a series of IDS alerts that appear to be false positives, but the analyst suspects an attacker is using a low-and-slow technique to evade detection. The alerts are individually below the threshold. What is the best way to detect this type of attack?

   • AImplement a correlation rule that counts similar alerts over a longer time window.
   • BDisable the signatures that are generating the alerts.
   • CManually review each alert in real time.
   • DIncrease the alert threshold to reduce noise.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An organization has a policy that all IDS alerts must be reviewed within 24 hours. The analyst is overwhelmed by the volume of alerts and cannot keep up. The analyst wants to reduce the workload without missing critical alerts. Which approach is most appropriate?

   • AReview alerts only once a week.
   • BIncrease the alert threshold to reduce the number of alerts.
   • CDisable all low-severity signatures.
   • DImplement a triage system that categorizes alerts by severity and assigns critical alerts for immediate review.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst is reviewing IDS alerts and notices that a single attacker IP is triggering multiple different signatures over a short period. The analyst wants to understand the overall attack pattern and prioritize the response. Which technique would be most helpful in this situation?

   • ADisable the signatures that are generating the most alerts to reduce noise.
   • BIncrease the severity of all alerts from that source IP to ensure they are noticed.
   • CManually review each alert individually to determine which one is most critical.
   • DUse alert correlation to group the related alerts into a single incident based on the common source IP and time window.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst notices that an attacker is sending fragmented IP packets that reassemble differently on the IDS sensor than on the target host. The analyst wants to reduce the chance of evasion while keeping false positives low. Which approach is most effective?

   • AEnable IP defragmentation on the sensor and configure the reassembly policy to match the target host's OS.
   • BDisable IP defragmentation on the sensor to avoid resource exhaustion.
   • CBlock all fragmented IP traffic at the firewall.
   • DIncrease the alert threshold for fragmented traffic to reduce noise.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization has a mix of Windows and Linux servers. The IDS is generating false positives for a signature that only affects Windows systems. The analyst wants to reduce noise while still detecting the attack on Windows. What is the best approach?

   • ADisable the signature for all systems.
   • BCreate a rule that only alerts when the destination is a Windows host.
   • CMove the IDS sensor to only monitor the Windows segment.
   • DIncrease the alert threshold for all signatures.
   Reveal Solution Discussion Select an answer first