nerdexam
GIAC

GSLC · Question #250

An IPS sensor triggers an alarm known as "signature firing". What events may occur in response? Each correct answer represents a complete solution. Choose all that apply.

The correct answer is A. Attacker's IP address is blocked B. Unauthorized packets are dropped C. A log entry is Created D. TCP connection is reset. When an IPS sensor fires a signature alert, all four response actions - blocking the source IP, dropping malicious packets, logging the event, and resetting the TCP connection - can occur simultaneously as part of standard inline IPS behavior.

Security Operations & Incident Response Leadership

Question

An IPS sensor triggers an alarm known as "signature firing". What events may occur in response? Each correct answer represents a complete solution. Choose all that apply.

Options

  • AAttacker's IP address is blocked
  • BUnauthorized packets are dropped
  • CA log entry is Created
  • DTCP connection is reset

How the community answered

(46 responses)
  • A
    100% (46)

Why each option

When an IPS sensor fires a signature alert, all four response actions - blocking the source IP, dropping malicious packets, logging the event, and resetting the TCP connection - can occur simultaneously as part of standard inline IPS behavior.

AAttacker's IP address is blockedCorrect

Blocking the attacker's IP address is a standard inline IPS response action that prevents further traffic from the offending source from reaching the network.

BUnauthorized packets are droppedCorrect

Dropping unauthorized or malicious packets is a core IPS inline response capability that stops harmful traffic from reaching its intended destination.

CA log entry is CreatedCorrect

Creating a log entry is a fundamental IPS response that provides an audit trail and supports forensic investigation of the triggered event.

DTCP connection is resetCorrect

Resetting the TCP connection is a standard IPS response action that terminates the session associated with the detected attack, cutting off the attacker's active communication channel.

Concept tested: IPS sensor signature firing response actions

Source: https://www.cisco.com/c/en/us/td/docs/security/ips/7-0/configuration/guide/idm/idmguide7/idm_sig_actions.html

Topics

#IPS#intrusion prevention#signature detection#incident response

Community Discussion

No community discussion yet for this question.

Full GSLC Practice