QUESTION: 49

Refer to the exhibit. IDS is producing an increased amount of false positive events about brute force attempts on the organization’s mail server. How should the Snort rule be modified to improve performance?

Block list of internal IPs from the rule
Change the rule content match to case sensitive
Set the rule to track the source IP
Tune the count and seconds threshold of the rule

Answer(s): B

Reveal Solution Next Question

QUESTION: 50

Where do threat intelligence tools search for data to identify potential malicious IP addresses, domain names, and URLs?

customer data
internal database
internal cloud
Internet

Answer(s): D

Reveal Solution Next Question

QUESTION: 51

An engineer wants to review the packet overviews of SNORT alerts. When printing the SNORT alerts, all the packet headers are included, and the file is too large to utilize. Which action is needed to correct this problem?

Modify the alert rule to “output alert_syslog: output log”
Modify the output module rule to “output alert_quick: output filename”
Modify the alert rule to “output alert_syslog: output header”
Modify the output module rule to “output alert_fast: output filename”

Answer(s): A

Reference:

https://snort-org-site.s3.amazonaws.com/production/document_files/files/000/000/249/original/ snort_manual.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIXACIED2SPMSC7GA%2F20201231%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20201231T141156Z&X-Amz- Expires=172800&X-Amz-SignedHeaders=host&X-Amz-Signature=e122ab6eb1659e13b3bc6bb2451ce693c0298b76c1962c3743924bc5fd83d382

Reveal Solution Next Question

QUESTION: 52 DRAG DROP

Drag and drop the type of attacks from the left onto the cyber kill chain stages at which the attacks are seen on the right.

Select and Place:

Exhibit A:

Exhibit B:

Please refer to Exhibit B for the answer.

Answer(s): A

Reveal Solution Next Question

Free 350-201 Exam Braindumps (page: 14)

QUESTION: 49

QUESTION: 50

QUESTION: 51

Reference:

QUESTION: 52 DRAG DROP

350-201 Discussions & Posts