NSE4 · Question #526
Which changes to IPS will reduce resource usage and improve performance? (Choose three)
The correct answer is A. In custom signature, remove unnecessary keywords to reduce how far into the signature tree B. In IPS sensors, disable signatures and rate based statistics (anomaly detection) for protocols, D. In firewall policies where IPS is not needed, disable IPS. To optimize IPS performance, one should refine custom signatures, selectively disable unneeded signatures and anomaly detection in IPS sensors, and disable IPS on firewall policies where it's not required.
Question
Which changes to IPS will reduce resource usage and improve performance? (Choose three)
Options
- AIn custom signature, remove unnecessary keywords to reduce how far into the signature tree
- BIn IPS sensors, disable signatures and rate based statistics (anomaly detection) for protocols,
- CIn IPS filters, switch from 'Advanced' to 'Basic' to apply only the most essential signatures.
- DIn firewall policies where IPS is not needed, disable IPS.
- EIn firewall policies where IPS is used, enable session start logs.
How the community answered
(18 responses)- A78% (14)
- C17% (3)
- E6% (1)
Why each option
To optimize IPS performance, one should refine custom signatures, selectively disable unneeded signatures and anomaly detection in IPS sensors, and disable IPS on firewall policies where it's not required.
Optimizing custom IPS signatures by removing redundant or inefficient keywords allows the IPS engine to process rules faster and traverse the signature tree more efficiently, reducing overhead.
Disabling signatures and rate-based statistics (anomaly detection) for protocols or services not in use or deemed low-risk reduces the amount of traffic the IPS engine needs to inspect, conserving resources.
There is no standard 'Advanced' to 'Basic' switch for IPS filters that universally applies only the 'most essential signatures'; IPS relies on granular selection or pre-defined sensors for optimization.
Disabling IPS inspection on firewall policies that handle trusted internal traffic or traffic to/from trusted sources significantly reduces the overall load on the IPS engine, as those sessions are no longer inspected.
Enabling session start logs increases logging overhead and resource consumption, which would *reduce* performance rather than improve it.
Concept tested: FortiGate IPS performance optimization
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/178553/ips-best-practices
Topics
Community Discussion
No community discussion yet for this question.