NSE4 · Question #504
You are creating a custom signature. Which has incorrect syntax?
The correct answer is A. F-SBID(--attack_id 1842,--name "Ping.Death";--protocol icmp; --data_size>32000;). The incorrect syntax in the custom signature is the use of a comma to separate parameters where a semicolon is required.
Question
You are creating a custom signature. Which has incorrect syntax?
Options
- AF-SBID(--attack_id 1842,--name "Ping.Death";--protocol icmp; --data_size>32000;)
- BF-SBID(--name "Block.SMTP.VRFY.CMD";--pattern "vrfy";-- service SMTP; --no_case;--
- CF-SBID(--name "Ping.Death";--protocol icmp;--data_size>32000;)
- DF-SBID(--name "Block".HTTP.POST"; --protocol tcp;-- service HTTP;-- flow from_client; --
How the community answered
(33 responses)- A76% (25)
- B9% (3)
- C3% (1)
- D12% (4)
Why each option
The incorrect syntax in the custom signature is the use of a comma to separate parameters where a semicolon is required.
FortiGate custom IPS signature definitions (F-SBID) require semicolons (`;`) to separate parameters within the signature definition, making the syntax `attack_id 1842,--name` incorrect due to the comma.
This syntax appears correct, with semicolons properly separating parameters like `--name`, `--pattern`, `--service`, and `--no_case`.
This syntax appears correct, using semicolons to separate `--name`, `--protocol`, and `--data_size` parameters.
This syntax also appears correct, using semicolons to separate `--name`, `--protocol`, `--service`, and `--flow` parameters.
Concept tested: FortiGate custom signature syntax
Source: https://docs.fortinet.com/document/fortigate/7.4.0/handbook/115469/custom-ips-signatures
Topics
Community Discussion
No community discussion yet for this question.