IDP Database Management JN0-336 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company has multiple security zones, each with different traffic profiles. The administrator wants to apply a consistent set of IDP attack objects to the DMZ zone but exclude a few objects that cause false positives on the web servers. The administrator also wants to ensure that future signature updates automatically include new attack objects in the DMZ policy. What should the administrator do?

   • AApply the default IDP policy to the DMZ and manually disable the false-positive objects in the policy
   • BCreate a custom attack object group for the DMZ, add the desired objects, and exclude the false-positive objects
   • CUse the predefined attack object group for the DMZ and rely on the signature update process to manage exclusions
   • DCreate a separate IDP policy for the DMZ that references the recommended attack object group
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which components are typically included in the IDP database?

   • AAttack objects and signatures
   • BUser accounts and password hashes
   • CSyslog messages and SNMP traps
   • DRouting tables and forwarding information
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A security administrator wants to ensure that IDP signatures are updated automatically on a weekly basis. The administrator configures the update schedule, but wants to verify that the schedule is correctly set. Which command should the administrator use to confirm the update schedule?

   • Ashow configuration security idp
   • Bshow security idp status
   • Cshow security idp policies
   • Dshow security idp attack-table version
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security administrator creates a custom attack object to detect a specific exploit. The object works correctly in a lab environment, but when deployed in production, it generates many false positives. The administrator needs to reduce false positives while maintaining detection. What should the administrator do?

   • AChange the signature to a stateless signature
   • BDisable the signature and rely on the default signatures
   • CIncrease the signature's severity to prioritize alerts
   • DAdd a context to the signature to restrict the match to a specific protocol field
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the main benefit of using attack object groups in IDP policies?

   • AThey reduce the number of attack objects in the database
   • BThey automatically update the attack objects in the group
   • CThey increase the detection accuracy of the IDP
   • DThey allow you to apply a set of attack objects to a policy as a single unit
   Reveal Solution Discussion Select an answer first