How does an IDP device evaluate rules within a rulebase?

In parallel, and all matching rules are applied

In order from top to bottom, and the first matching rule is applied

In order from bottom to top, and the last matching rule is applied

Randomly, and the action is chosen by the highest severity

An IDP policy has a rule that matches a specific attack and the action is set to 'drop'. However, the administrator notices that the attack is still being logged but the traffic is not being blocked. What is the most likely cause?

The 'drop' action is not supported for that attack object.

The 'drop' action only works for TCP traffic, not UDP.

The IDP policy is not applied to the correct zone.

The rule is placed after another rule that matches the traffic with an 'ignore' action.

An IDP policy is generating a high number of false positives for a custom attack object that matches a legitimate application's traffic pattern. The administrator wants to reduce false positives without completely disabling the attack object. Which approach is most effective?

Move the rule to the bottom of the rulebase to reduce its priority.

Increase the threshold for the attack object to require more matches before triggering.

Disable the attack object in the rule to stop all detection.

Change the rule action to 'ignore' to stop logging but keep detection.

Which technique is commonly used to reduce false positives in an IDP policy?

Disabling the IDP rulebase entirely

Increasing the severity level of all rules

Adjusting the sensitivity or threshold of attack objects

Changing the action from drop to ignore

Juniper NetworksCertified Specialist, Security (JNCIS-SEC)

Domain 1Objective 2

IDP Policy JN0-336 Practice Questions (Page 4)

Part of the Intrusion Detection and Prevention (IDP) domain, which makes up ~10% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

7concepts

Questions 16–20

16foundation · easy
How does an IDP device evaluate rules within a rulebase?
Select an answer first
17foundation · easy
What is the correct order of components in an IDP policy hierarchy, from highest to lowest?
Select an answer first
18expert · medium
An IDP policy has a rule that matches a specific attack and the action is set to 'drop'. However, the administrator notices that the attack is still being logged but the traffic is not being blocked. What is the most likely cause?
Select an answer first
19expert · medium
An IDP policy is generating a high number of false positives for a custom attack object that matches a legitimate application's traffic pattern. The administrator wants to reduce false positives without completely disabling the attack object. Which approach is most effective?
Select an answer first
20foundation · easy
Which technique is commonly used to reduce false positives in an IDP policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-336

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-336” is a trademark of its owner, used for identification only.