A customer has an AOS 10 architecture, which includes Aruba APs. Admins have recently enabled WIDS at the high level. They also enabled alerts and email notifications for several events, as shown in…

Question

Exhibit

Options

• ASend the email notifications directly to a specific folder, and only check the folder once a week.
• BDisable email notifications for Roque AP, but leave the Infrastructure Attack Detected and Client
• CChange the WIDS level to custom, and enable only the checks most likely to indicate real threats.
• DDisable just the Rogue AP and Client Attack Detected alerts, as they overlap with the

• A
  16% (4)
• B
  4% (1)
• C
  72% (18)
• D
  8% (2)

Explanation

WIDS is a feature that monitors the radio spectrum for the presence of unauthorized, rogue access points and the use of wireless attack tools. WIDS can be configured at different levels, such as low, medium, high, or custom. The higher the level, the more checks are enabled and the more alerts are generated. However, not all checks are equally relevant or indicative of real threats. Some checks may generate false positives or unnecessary alerts that can overwhelm the administrators and reduce the effectiveness of WIDS. Therefore, one step that could be recommended to reduce the number of email notifications is to change the WIDS level to custom, and enable only the checks most likely to indicate real threats. This way, the administrators can fine-tune the WIDS settings to suit their network environment and security needs, and avoid getting flooded with irrelevant or redundant alerts.

No community discussion yet for this question.