An engineer is examining alerts by an IDS that uses SNORT technology and notices many false positives. This rule is firing inside a "local rules" file. (10.10.x.x any -> $HOME_NET 21 (msg:"FTP…

Question

Options

• ARecreate the "local rules" file from scratch and monitor if false positive alerts stop.
• BRecreate every line except the offending rule and monitor if false positive alerts stop.
• CComment out the offending rule and monitor if false positive alerts stop.
• DComment out every line and monitor if false positive alerts stop.

• A
  10% (3)
• B
  3% (1)
• C
  79% (23)
• D
  7% (2)

Explanation

Option C is correct because commenting out the specific rule is the standard, surgical troubleshooting method - it isolates the suspected cause (the rule) without disrupting any other detection logic, allowing the engineer to confirm whether that single rule is responsible for the false positives while keeping all other rules active.

Why the distractors fail:

• A - Recreating the entire file from scratch is destructive and unnecessary; you'd lose all custom rule context and still wouldn't pinpoint which rule caused the problem.
• B - Recreating every line except the offending one is essentially deleting and rewriting the same file, which is wasteful effort compared to simply commenting one line; it also risks introducing transcription errors.
• D - Commenting out every line disables all local rules at once, so you can't isolate whether the one suspicious rule is actually the culprit - it's the sledgehammer approach when a scalpel is needed.

Memory tip: Think "comment to confirm" - in SNORT troubleshooting, always comment out the minimum necessary to test your hypothesis. The goal is isolation, not elimination. If the false positives stop after commenting one rule, you've found your culprit without breaking anything else.

No community discussion yet for this question.