A security team manages thousands of IDS rules. They need to generate reports on the types of attacks detected and correlate them with MITRE ATT&CK techniques. Which rule components should they standardize on to enable this reporting?

Use 'threshold' and 'suppress' to control alert volume.

Use 'sid' and 'rev' for unique identification and versioning.

Use 'content' and 'offset' to define detection patterns.

Use 'classtype' for attack categories and 'metadata' for MITRE ATT&CK technique IDs.

An analyst is writing a rule to detect a specific pattern in the payload of a TCP packet. The pattern is a binary string that may appear at any offset. Which rule option is most appropriate to match this pattern?

threshold:type limit, track by_src, count 5, seconds 60;

An organization uses a large rule set with multiple rules that generate alerts for the same type of attack. The analyst wants to reduce the number of alerts by grouping related rules and applying a single threshold to the group. Which approach is the most effective?

Assign the same 'sid' to the related rules.

Create a separate rule file for the related rules and apply a threshold to the file.

Use the 'tag' option to group the alerts.

Assign the same 'classtype' to the related rules and use a threshold that applies to the classtype.

An analyst is writing a Suricata rule to detect a known HTTP exploit that sends a specific string in the User-Agent header. The analyst wants to ensure the rule only matches when the string appears in the HTTP header, not elsewhere in the payload. Which rule option is essential for this?

content:"string"; http_user_agent;

A Snort rule is generating a high volume of alerts for a legitimate application. The analyst has determined that the alerts are true positives for the application's normal behavior, but they are not security incidents. The analyst wants to reduce the alert volume while still detecting actual attacks that use the same application. The analyst has identified that attacks always use a specific TCP flag combination that is not present in normal traffic. Which tuning approach is the most effective?

Increase the threshold to require more matches within a time window.

Add a 'flags' option to the rule that requires the attack-specific flag combination.

Assign a new 'classtype' to the rule to reduce its priority.

Change the rule action to 'drop' to block the application traffic.

GIAC Certified Intrusion Analyst

Domain 3Objective 3

Intrusion Detection System Rules GCIA Practice Questions (Page 3)

Part of the IDS Concepts and Architecture domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 11–15

11expert · hard
A security team manages thousands of IDS rules. They need to generate reports on the types of attacks detected and correlate them with MITRE ATT&CK techniques. Which rule components should they standardize on to enable this reporting?
Select an answer first
12application · medium
An analyst is writing a rule to detect a specific pattern in the payload of a TCP packet. The pattern is a binary string that may appear at any offset. Which rule option is most appropriate to match this pattern?
Select an answer first
13expert · hard
An organization uses a large rule set with multiple rules that generate alerts for the same type of attack. The analyst wants to reduce the number of alerts by grouping related rules and applying a single threshold to the group. Which approach is the most effective?
Select an answer first
14application · medium
An analyst is writing a Suricata rule to detect a known HTTP exploit that sends a specific string in the User-Agent header. The analyst wants to ensure the rule only matches when the string appears in the HTTP header, not elsewhere in the payload. Which rule option is essential for this?
Select an answer first
15expert · hard
A Snort rule is generating a high volume of alerts for a legitimate application. The analyst has determined that the alerts are true positives for the application's normal behavior, but they are not security incidents. The analyst wants to reduce the alert volume while still detecting actual attacks that use the same application. The analyst has identified that attacks always use a specific TCP flag combination that is not present in normal traffic. Which tuning approach is the most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.