SY0-701 Question 321
Single answerIDS/IPS: Trends , SignaturesA security administrator deployed a network IPS at the internet edge and enabled a vendor-provided signature pack to block known web attacks. During the first week, the IPS generated thousands of alerts for a partner application that uses unusual but approved HTTP requests. After reviewing packet captures, the administrator confirms the traffic is legitimate. Management still wants the IPS to continue blocking known malicious activity, including new exploits as they emerge, but they want far fewer false positives from this application. Which action would BEST address this requirement?
- A
Disable signature-based detection and rely only on anomaly-based analysis for all web traffic
- B
Tune the IPS by modifying or suppressing the specific signatures matching the approved application traffic while continuing regular signature updates
- C
Move the IPS to a SPAN port so it can monitor the traffic without interfering with the partner application
- D
Replace the IPS with a basic packet-filtering firewall rule that permits all HTTP traffic from the partner network
Show answer and explanation
Correct answer: B
Explanation
The best answer is to tune the IPS signatures affecting the approved application while continuing to consume current signature updates. In practice, signature-based IDS/IPS technologies are highly effective for detecting known threats, but they require ongoing tuning to align detection with the environment's normal traffic patterns. This commonly includes adjusting alert thresholds, creating exceptions, disabling noisy signatures for specific hosts or applications, or applying policy-based suppression. Security teams should avoid broad changes that remove preventive capability altogether when the issue is limited to false positives from known legitimate behavior. This aligns with common vendor and industry guidance from IDS/IPS platforms such as Snort, Suricata, Cisco, Palo Alto Networks, and other enterprise IPS solutions, which emphasize signature updates plus environment-specific tuning as standard operational practice.
- A. Incorrect.
This is incorrect because removing signature-based detection entirely would reduce the IPS's ability to identify and block known attack patterns. Signature-based detection is specifically valuable for matching established threats and newly released indicators delivered through vendor updates. Anomaly-based methods can help identify deviations from a baseline, but they are not a direct replacement for signatures and can also produce false positives if baselines are not well tuned.
- B. Correct.
This is correct because the problem is not that signature-based detection is inherently wrong, but that some signatures are matching legitimate application behavior. The best practice is to tune the IPS by disabling, suppressing, thresholding, or customizing the specific noisy signatures for that approved traffic pattern, while still keeping signature feeds updated to detect current threats. This preserves protection against known malicious activity and reduces false positives tied to the business application.
- C. Incorrect.
This is incorrect because moving the IPS to a SPAN port would effectively turn it into passive monitoring only, similar to IDS behavior. That would reduce business impact from blocking, but it would no longer meet the requirement to continue blocking known malicious traffic. The issue presented is false positives from specific signatures, not a need to stop prevention entirely.
- D. Incorrect.
This is incorrect because a packet-filtering firewall rule that broadly permits HTTP traffic from the partner network would not provide the same visibility or protection as an IPS. Firewalls primarily make decisions based on rules such as IPs, ports, and protocols, whereas IPS signatures inspect content and patterns associated with attacks. Allowing all partner HTTP traffic would likely create a security gap rather than solve the false-positive issue safely.