An analyst is tuning an IDS and wants to reduce false positives caused by a legitimate backup process that runs nightly. The backup traffic matches a known attack signature. Which tuning action is most appropriate?

Increase the alert threshold for all signatures.

Disable the signature permanently.

Move the IDS sensor to a different network segment.

Create a time-based suppression rule that disables the signature during the backup window.

GIAC Certified Intrusion Analyst

Domain 3Objective 2

Advanced IDS Concepts GCIA Practice Questions (Page 6)

Part of the IDS Concepts and Architecture domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

1concept

Questions 26–26

26application · medium
An analyst is tuning an IDS and wants to reduce false positives caused by a legitimate backup process that runs nightly. The backup traffic matches a known attack signature. Which tuning action is most appropriate?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

Advanced IDS Concepts GCIA Practice Questions (Page 6)

Questions 26–26

An analyst is tuning an IDS and wants to reduce false positives caused by a legitimate backup process that runs nightly. The backup traffic matches a known attack signature. Which tuning action is most appropriate?

Keep studying — IDS Concepts and Architecture