Check_Point
156-915.76 · Question #271
You have selected the event "port scan from internal network in Eventia Analyzer", to detect an event when 30 ports have occurred when 60 seconds. You want to detect two ports scans from a host…
The correct answer is D. Select the two port-scan detections as an exception. See the full explanation below for the reasoning.
Question
You have selected the event "port scan from internal network in Eventia Analyzer", to detect an event when 30 ports have occurred when 60 seconds. You want to detect two ports scans from a host within 10 seconds of each other. How would you accomplish this?
Options
- AYou cannot set Eventia Analyzer to detect two port scans within 10 seconds of each other.
- BSelect the two port-scan detections as a new event.
- CSelect the two port-scan detections as a sub event.
- DSelect the two port-scan detections as an exception.
How the community answered
(48 responses)- A8% (4)
- B17% (8)
- C4% (2)
- D71% (34)
Community Discussion
No community discussion yet for this question.