GSLC · Question #250
An IPS sensor triggers an alarm known as "signature firing". What events may occur in response? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is A. Attacker's IP address is blocked B. Unauthorized packets are dropped C. A log entry is Created D. TCP connection is reset. When an IPS sensor fires a signature alert, all four response actions - blocking the source IP, dropping malicious packets, logging the event, and resetting the TCP connection - can occur simultaneously as part of standard inline IPS behavior.
Question
An IPS sensor triggers an alarm known as "signature firing". What events may occur in response? Each correct answer represents a complete solution. Choose all that apply.
Options
- AAttacker's IP address is blocked
- BUnauthorized packets are dropped
- CA log entry is Created
- DTCP connection is reset
How the community answered
(46 responses)- A100% (46)
Why each option
When an IPS sensor fires a signature alert, all four response actions - blocking the source IP, dropping malicious packets, logging the event, and resetting the TCP connection - can occur simultaneously as part of standard inline IPS behavior.
Blocking the attacker's IP address is a standard inline IPS response action that prevents further traffic from the offending source from reaching the network.
Dropping unauthorized or malicious packets is a core IPS inline response capability that stops harmful traffic from reaching its intended destination.
Creating a log entry is a fundamental IPS response that provides an audit trail and supports forensic investigation of the triggered event.
Resetting the TCP connection is a standard IPS response action that terminates the session associated with the detected attack, cutting off the attacker's active communication channel.
Concept tested: IPS sensor signature firing response actions
Source: https://www.cisco.com/c/en/us/td/docs/security/ips/7-0/configuration/guide/idm/idmguide7/idm_sig_actions.html
Topics
Community Discussion
No community discussion yet for this question.