300-215 · Question #29
Refer to the exhibit. A company that uses only the Unix platform implemented an intrusion detection system. After the initial configuration, the number of alerts is overwhelming, and an engineer…
The correct answer is C. False Positive alert. The alert shown is based on a Snort rule for a Unicode directory traversal attack against IIS web servers (Microsoft platform). The key detail here is the payload content "../..%c0%af../" which is a classic IIS-specific exploit related to CVE-2000-0884. Since the company only…
Question
Refer to the exhibit. A company that uses only the Unix platform implemented an intrusion detection system. After the initial configuration, the number of alerts is overwhelming, and an engineer needs to analyze and classify the alerts. The highest number of alerts were generated from the signature shown in the exhibit. Which classification should the engineer assign to this event?
Exhibit
Options
- ATrue Negative alert
- BFalse Negative alert
- CFalse Positive alert
- DTrue Positive alert
How the community answered
(20 responses)- A5% (1)
- B5% (1)
- C70% (14)
- D20% (4)
Explanation
The alert shown is based on a Snort rule for a Unicode directory traversal attack against IIS web servers (Microsoft platform). The key detail here is the payload content "../..%c0%af../" which is a classic IIS-specific exploit related to CVE-2000-0884. Since the company only uses Unix systems, they are not vulnerable to this IIS-specific attack. Therefore, these alerts are triggered by irrelevant traffic or misapplied signatures, resulting in False Positives. False Positive: an alert is generated for traffic that is not actually malicious or relevant to the protected environment.
Topics
Community Discussion
No community discussion yet for this question.