Intrusion Detection System Rules GCIA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A Snort rule is generating a high volume of alerts for a legitimate application that uses a specific protocol. The analyst has confirmed the rule is correctly written and the alerts are true positives for the protocol, but they are not security incidents. Which tuning method would best reduce the alert volume while still detecting actual attacks?

   • AAdd a 'tag' option to group related alerts.
   • BDisable the rule and create a new one with a different SID.
   • CIncrease the threshold to require more matches within a time window.
   • DChange the rule to use 'content' with a more specific pattern that only matches attack traffic.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A Snort rule that alerts on a specific exploit signature is generating hundreds of alerts per minute from a single internal host that is scanning the network. The analyst confirms the alerts are true positives but wants to reduce the noise while still detecting subsequent attempts. Which approach is most appropriate?

   • ARemove the rule from the configuration to stop the alerts.
   • BAdd a threshold option to limit alerts to one per source IP per minute.
   • CIncrease the rule's sid number to a higher value.
   • DChange the rule action to 'pass' so the traffic is ignored.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of tuning IDS rules?

   • ATo increase the number of alerts generated
   • BTo reduce false positives and improve detection accuracy
   • CTo make rules harder to evade
   • DTo change the rule action from alert to drop
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst is tuning a Snort rule that currently alerts on any HTTP response containing the string 'admin'. The rule is generating too many false positives because 'admin' appears in benign pages. The analyst wants to reduce false positives by requiring the string to appear only in the HTTP body, not in headers, and to require the 'PSH' flag to be set. Which rule options should be added?

   • Acontent:"admin"; http_header; flags:A;
   • Bcontent:"admin"; http_uri; flags:S;
   • Ccontent:"admin"; http_client_body; flags:PSH;
   • Dcontent:"admin"; http_method; flags:PSH;
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst has written a new Suricata rule to detect a specific exploit. Before deploying it to production, the analyst wants to verify that the rule fires on a packet capture containing the exploit and does not fire on normal traffic. Which tool or method is most appropriate for this validation?

   • AUse a packet generator to send random traffic through the sensor.
   • BReview the rule syntax with a text editor and manually verify the logic.
   • CDeploy the rule to production and monitor the alert logs for a week.
   • DRun Suricata in offline mode against the packet captures and review the alerts.
   Reveal Solution Discussion Select an answer first