Refer to the exhibit. `` rule id 100 event type tcp event action alert source address any destination address any source port any destination port 80 protocol tcp `` The rule is configured to alert…

Question

rule id 100
event type tcp
event action alert
source address any
destination address any
source port any
destination port 80
protocol tcp

Options

• AAdd the rule to only alert traffic that matches a specific signature.
• BFilter out the false positives manually.
• CReconfigure the rule to only alert traffic from specific IP addresses or ranges.
• DDisable the rule.

• A
  13% (5)
• B
  8% (3)
• C
  77% (30)
• D
  3% (1)

Explanation

Reconfiguring the rule to alert only on traffic from specific IP addresses or ranges (C) directly addresses the root cause: the rule is too broad, catching all port 80 traffic including legitimate web browsing. By scoping the source or destination addresses to known suspicious or untrusted IP ranges, the rule becomes surgical rather than a blanket net, eliminating false positives while preserving detection capability.

Why the others are wrong:

• A is tempting but misframes the fix - adding a signature match changes what the rule inspects (payload content), not who it applies to; the question describes traffic-volume false positives, not content-matching issues.
• B (manual filtering) is operationally unsustainable and doesn't fix the rule itself - it's a workaround, not a solution.
• D (disable the rule) removes all detection entirely, trading false positives for false negatives, which is worse from a security posture standpoint.

Memory tip: Think "scalpel, not sledgehammer" - when a rule is too broad, narrow the scope (IP/range restriction) before reaching for content signatures or operational workarounds. If the traffic type is correct but the source is legitimate, restrict by address.

No community discussion yet for this question.