The signature filter of IPS is a collection of signatures that meet specified filtering conditions. Which of the following does the signature filter's filter criteria not include?

Question

Options

• AThreat Category
• BSignature ID
• COperating system
• DAgreement

• A
  2% (1)
• B
  83% (38)
• C
  11% (5)
• D
  4% (2)

Explanation

Signature ID (option B) is not a filter criterion because it is a unique identifier for an individual signature - it's used to reference a specific signature directly, not to group or classify signatures. A filter, by design, applies broad categorical attributes to match sets of signatures, making a specific ID redundant in that context.

Why the distractors are wrong (meaning they ARE valid filter criteria): Threat Category (A) classifies signatures by attack type (e.g., malware, DoS), which is a core grouping attribute. Operating System (C) narrows which signatures apply to a target's OS (Windows, Linux, etc.), a standard filter dimension. Agreement/Protocol (D) - likely translated from the Chinese term for "protocol" - filters signatures by the network protocol they target (HTTP, DNS, etc.), which is also a standard criterion.

Memory tip: Think of a signature filter as a search form with dropdown menus (category, OS, protocol) - you fill in broad attributes to retrieve matching groups. A Signature ID is like knowing the exact part number already; you look it up directly rather than filter for it.

No community discussion yet for this question.