In a corporate environment, a security analyst must refine an intrusion detection system rule that erroneously flags secure file transfer protocol (SFTP) traffic as suspicious during large data…

Question

Options

• ARequire manual verification for all SFTP sessions that exceeds the threshold.
• BApply stricter byte thresholds exclusively to external IP addresses.
• CImplement a whitelist for known internal IP addresses during peak transfer times.
• DModify the rule to check the ratio of incoming to outgoing packets.

• A
  10% (2)
• B
  71% (15)
• C
  5% (1)
• D
  14% (3)

Explanation

Option B is correct because applying stricter byte thresholds only to external IP addresses adds context-awareness to the rule - internal SFTP traffic is generally trusted and expected to be high-volume, while external connections warrant higher scrutiny at lower thresholds, improving specificity without creating blind spots for genuine threats.

Option A is wrong because requiring manual review for every session exceeding the threshold doesn't reduce false positives - it just shifts the burden to analysts and creates operational bottlenecks, especially during legitimate large transfers.

Option C is wrong because whitelisting internal IPs during peak transfer times only leaves those same IPs unmonitored during off-peak hours when an attacker might deliberately time an exfiltration, creating a security gap.

Option D is wrong because the incoming-to-outgoing packet ratio is a metric better suited for detecting DDoS or port scanning activity, not for distinguishing legitimate from suspicious SFTP data volume - it doesn't address the root cause of the false positives.

Memory tip: Think "External = Extra scrutiny." The key principle is scope reduction - a rule fires too broadly, so you narrow who it applies strict thresholds to (external IPs) rather than weakening what it monitors or adding manual workarounds.

No community discussion yet for this question.