350-201 Question 124
Select 3A security analyst at your organization has noticed an increased number of false positives being generated by the intrusion prevention system (IPS) after a recent rule update. The analyst has requested your assistance in tuning the IPS to reduce the false positives without compromising security. Which actions should you take to address this issue?
- A
Modify the IPS rules to increase the sensitivity thresholds for specific false-positive alerts.
- B
Disable the specific IPS signatures generating false positives across the entire network.
- C
Apply whitelisting for trusted IP addresses or applications that are triggering the false-positive alerts.
- D
Review and adjust the IPS rules to align with the organization's unique traffic patterns.
- E
Enable logging for the signatures generating false positives and monitor for legitimate threats before making changes.
Show answer and explanation
Correct answers: C, D, E
Explanation
Reducing false positives in an IPS requires a balanced approach that retains the system's ability to detect threats while minimizing unnecessary alerts. Whitelisting trusted entities, tailoring rules to match organizational needs, and monitoring logs for additional insights are all best practices for effective tuning. These actions ensure the IPS is both accurate and secure.
- A. Incorrect.
Increasing the sensitivity thresholds might reduce false positives, but it could also lower the IPS's ability to detect legitimate threats, which is not recommended without proper testing.
- B. Incorrect.
Completely disabling IPS signatures can leave the network vulnerable to legitimate threats and is not a best practice for tuning.
- C. Correct.
Whitelisting trusted IP addresses or applications is an effective way to reduce false positives in scenarios where those specific entities are known to be safe.
- D. Correct.
Adjusting IPS rules to match the organization's traffic patterns ensures that the IPS is tailored to the specific environment, reducing false positives while maintaining security.
- E. Correct.
Monitoring logs for signatures generating false positives helps validate whether these alerts are legitimate or need tuning, which is a critical step before making permanent changes.