A security analyst is reviewing IDS alerts and notices that a single alert has been generated thousands of times in the past hour for the same source and destination IPs. The analyst determines it is a false positive caused by a misconfigured application. What is the most appropriate action?

Disable the IDS until the application is fixed

Increase the severity of the alert to ensure it is not missed

Delete the alerts from the log to reduce storage usage

Modify the IDS rule to suppress this specific false positive pattern

A security team has deployed Snort as their NIDS. They need to verify that it correctly detects a specific SQL injection attack. What is the most effective method to test this?

Send a benign HTTP request to the web server and check for alerts

Launch the SQL injection attack against a test web server and verify an alert is generated

Check the Snort version to ensure it is up to date

Review the Snort configuration file for syntax errors

What is the purpose of testing an IDS by sending known attack patterns to the network?

To measure the network bandwidth

To update the IDS signature database

To verify that the IDS generates alerts for those patterns

Certified Tester Security Tester

Domain 5Objective 5

Intrusion Detection CT-SEC Practice Questions (Page 3)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

8concepts

Questions 11–15

11application · medium
A security analyst is reviewing IDS alerts and notices that a single alert has been generated thousands of times in the past hour for the same source and destination IPs. The analyst determines it is a false positive caused by a misconfigured application. What is the most appropriate action?
Select an answer first
12application · medium
A security team has deployed Snort as their NIDS. They need to verify that it correctly detects a specific SQL injection attack. What is the most effective method to test this?
Select an answer first
13application · medium
An organization is concerned about insider threats where an employee modifies critical files on a server. They want to detect unauthorized file changes in real time. Which type of IDS is best suited for this requirement?
Select an answer first
14expert · hard
A security team is evaluating a new IDS. In a test with 200 real attacks and 800 normal events, the IDS generates 150 alerts. Of these, 120 are for real attacks and 30 are for normal events. Additionally, 80 real attacks are not detected. What is the false positive rate?
Select an answer first
15foundation · easy
What is the purpose of testing an IDS by sending known attack patterns to the network?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Intrusion Detection CT-SEC Practice Questions (Page 3)

Questions 11–15

A security analyst is reviewing IDS alerts and notices that a single alert has been generated thousands of times in the past hour for the same source and destination IPs. The analyst determines it is a false positive caused by a misconfigured application. What is the most appropriate action?

A security team has deployed Snort as their NIDS. They need to verify that it correctly detects a specific SQL injection attack. What is the most effective method to test this?

An organization is concerned about insider threats where an employee modifies critical files on a server. They want to detect unauthorized file changes in real time. Which type of IDS is best suited for this requirement?

A security team is evaluating a new IDS. In a test with 200 real attacks and 800 normal events, the IDS generates 150 alerts. Of these, 120 are for real attacks and 30 are for normal events. Additionally, 80 real attacks are not detected. What is the false positive rate?

What is the purpose of testing an IDS by sending known attack patterns to the network?

Keep studying — Testing Security Mechanisms