What is the purpose of a classification key in an IDS rule?

To categorize the type of attack or policy violation

To determine the rule's protocol

An organization uses Suricata in inline mode. The analyst needs to write a rule that blocks a known exploit and generates an alert. The exploit uses TCP from any source to the internal server 192.168.2.10 on port 445. Which rule is correctly formatted and meets the requirement?

drop tcp 192.168.2.10 445 -> any any (msg:"exploit"; sid:1000003;)

reject tcp any any -> 192.168.2.10 445 (msg:"exploit"; sid:1000003;)

alert tcp any any -> 192.168.2.10 445 (msg:"exploit"; sid:1000003;)

drop tcp any any -> 192.168.2.10 445 (msg:"exploit"; sid:1000003;)

An organization uses a large rule set and wants to quickly identify which rules are related to web application attacks. The analyst has been asked to organize the rules so that they can be filtered by this category. Which approach is the most effective?

Use a unique 'sid' range for web application rules.

Include the word 'web' in the 'msg' option of each rule.

Assign a consistent 'classtype' value, such as 'web-application-attack', to all relevant rules.

Create a separate rule file for web application rules.

A Snort rule alerts on a specific malware signature, but it is firing on legitimate internal traffic that contains the same byte sequence. The analyst has confirmed the rule is correctly written. Which tuning approach would most effectively reduce false positives while maintaining detection of the malware?

Disable the rule and rely on other rules.

Change the rule action from 'alert' to 'drop'.

Add a 'content' option to match a second, more specific byte sequence that is unique to the malware.

Add a 'threshold' option to require a minimum number of matches within a time window.

In the rule header 'alert tcp any any -> 192.168.1.0/24 80', what does the 'any any' portion specify?

Destination IP and destination port

Source port and destination port

GIAC Certified Intrusion Analyst

Domain 3Objective 3

Intrusion Detection System Rules GCIA Practice Questions (Page 4)

Part of the IDS Concepts and Architecture domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 16–20

16foundation · easy
What is the purpose of a classification key in an IDS rule?
Select an answer first
17expert · hard
An organization uses Suricata in inline mode. The analyst needs to write a rule that blocks a known exploit and generates an alert. The exploit uses TCP from any source to the internal server 192.168.2.10 on port 445. Which rule is correctly formatted and meets the requirement?
Select an answer first
18application · medium
An organization uses a large rule set and wants to quickly identify which rules are related to web application attacks. The analyst has been asked to organize the rules so that they can be filtered by this category. Which approach is the most effective?
Select an answer first
19application · medium
A Snort rule alerts on a specific malware signature, but it is firing on legitimate internal traffic that contains the same byte sequence. The analyst has confirmed the rule is correctly written. Which tuning approach would most effectively reduce false positives while maintaining detection of the malware?
Select an answer first
20foundation · easy
In the rule header 'alert tcp any any -> 192.168.1.0/24 80', what does the 'any any' portion specify?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.