Advanced IDS Concepts GCIA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which technique is commonly used by attackers to avoid detection by an IDS that relies on pattern matching of packet payloads?

   • ASending the attack from a spoofed source IP address
   • BIncreasing the TTL value on attack packets
   • CFragmentation of the attack payload across multiple packets
   • DUsing a higher TCP window size for the connection
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An analyst is tuning an IDS that is deployed inline. The IDS is dropping packets under heavy load, and the analyst suspects that the sensor is missing attacks. The organization cannot afford to upgrade the hardware immediately. Which action is most appropriate to improve detection while maintaining inline operation?

   • AIncrease the sensor's buffer size to hold more packets.
   • BDisable all alerts to reduce load.
   • CSwitch the sensor to passive mode to avoid dropping packets.
   • DReduce the number of enabled signatures to only those that are critical.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An attacker is using a tool that sends packets with intentionally invalid TCP checksums to evade an IDS. The analyst wants to ensure the sensor still detects the attack. What is the best approach?

   • AConfigure the sensor to ignore packets with invalid checksums.
   • BEnable checksum validation on the sensor so it drops invalid packets.
   • CIncrease the sensor's buffer size to handle more packets.
   • DDisable checksum validation on the sensor so it processes all packets.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An organization has deployed an IDS and is experiencing a high number of false positives due to internal applications that generate traffic patterns similar to known attacks. The security team wants to reduce the noise while maintaining detection of genuine threats. What is the most effective approach?

   • ADisable the IDS during peak business hours when the false positives are most frequent.
   • BIncrease the sensitivity of all IDS rules to catch more potential threats.
   • CCreate custom rules that whitelist the specific internal application traffic patterns that are causing false positives.
   • DSet the IDS to log all alerts but not display them in the console to reduce analyst workload.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An organization has a compliance requirement to retain IDS alerts for two years, but the current storage solution is filling up quickly. The analyst must reduce storage usage without losing the ability to investigate past incidents. Which approach is most appropriate?

   • AIncrease the alert threshold to generate fewer alerts.
   • BImplement alert aggregation and store only summarized alert data after a retention period.
   • CDelete alerts older than six months.
   • DCompress the alert logs but keep all raw data.
   Reveal Solution Discussion Select an answer first