210-250 · Question #9
Which event occurs when a signature-based IDS encounters network traffic that triggers an alert?
The correct answer is D. intrusion event. A signature-based IDS generates an intrusion event when network traffic matches a known attack signature pattern. This is the standard classification for IDS/IPS signature-triggered alerts.
Question
Which event occurs when a signature-based IDS encounters network traffic that triggers an alert?
Options
- Aconnection event
- Bendpoint event
- CNetFlow event
- Dintrusion event
How the community answered
(59 responses)- A2% (1)
- B5% (3)
- C2% (1)
- D92% (54)
Why each option
A signature-based IDS generates an intrusion event when network traffic matches a known attack signature pattern. This is the standard classification for IDS/IPS signature-triggered alerts.
A connection event logs metadata about a network session (start/end time, bytes transferred, hosts) and is not triggered by signature matches.
An endpoint event originates from host-based security agents monitoring activity on a specific device, not from network-based IDS signature analysis.
A NetFlow event captures IP traffic flow metadata for analysis but is unrelated to signature-based detection or alert generation.
When a signature-based IDS matches inbound or outbound traffic against a known attack signature, it classifies the result as an intrusion event. This term is the industry-standard label used in platforms like Cisco Firepower and Snort to distinguish signature-triggered alerts from other event types. Intrusion events contain details such as the triggered rule, source/destination, and threat classification.
Concept tested: Signature-based IDS intrusion event classification
Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/intrusion_events.html
Topics
Community Discussion
No community discussion yet for this question.