JN0-633 · Question #169
Click the Exhibit button. [edit security idp-policy test] user@host# show rulebase-ips { rule R3 { match { source-address any; destination-address any; attacks { predefined-attacks FTP:USER:ROOT; }…
The correct answer is C. Delete theterminalstatement from the R3 rule. See the full explanation below for the reasoning.
Question
Click the Exhibit button. [edit security idp-policy test] user@host# show rulebase-ips { rule R3 { match { source-address any; destination-address any; attacks { predefined-attacks FTP:USER:ROOT; } } then { action { recommended; } } terminal; } rule R4 { match { source-address any; destination-address any; attacks { predefined-attacks HTTP:HOTMAIL:FILE-UPLOAD; } } then { action { recommended; } } } } You have just committed the new IDP policy shown in the exhibit. However, you notice no action is taken on traffic matching the R4 IDP rule. Which two actions will resolve the problem? (Choose two.)
Options
- AChange the R4 rule to match on a predefined attack group.
- BInsert the R4 rule above the R3 rule.
- CDelete theterminalstatement from the R3 rule.
- DChange the IPS rulebase to an exempt rulebase.
How the community answered
(25 responses)- A4% (1)
- B16% (4)
- C72% (18)
- D8% (2)
Community Discussion
No community discussion yet for this question.