Refer to the exhibit. IDS is producing an increased amount of false positive events about brute force attempts on the organization's mail server. How should the Snort rule be modified to improve performance?
A) Block list of internal IPs from the rule
B) Change the rule content match to case sensitive
C) Set the rule to track the source IP
D) Tune the count and seconds threshold of the rule

Question

Refer to the exhibit. IDS is producing an increased amount of false positive events about brute force attempts on the organization's mail server. How should the Snort rule be modified to improve performance?
A) Block list of internal IPs from the rule 
B) Change the rule content match to case sensitive 
C) Set the rule to track the source IP 
D) Tune the count and seconds threshold of the rule

Quizplus · Accepted Answer

The Answer of  Refer to the exhibit. IDS is producing an increased amount of false positive events about brute force attempts on the organization's mail server. How should the Snort rule be modified to improve performance?
A) Block list of internal IPs from the rule 
B) Change the rule content match to case sensitive 
C) Set the rule to track the source IP 
D) Tune the count and seconds threshold of the rule

Refer to the Exhibit