Examice

Exam nse7_efw-72 All QuestionsBrowse all questions from this exam

Question 50

You want to block access to the website www.eicar.org using a custom IPS signature.

Which custom IPS signature should you configure?

F-SBID ( --name “detect_eicar”; --protocol udp; --service ssl; --flow from_client; --pattern “www.eicar.org”; --no_case; --context host;)

F-SBID ( --name “eicar”; --protocol udp; --flow from_server; --pattern “eicar”; --context host;)

F-SBID ( --name “detect_eicar”; --protocol tcp; --service dns; --flow from_server; --pattern “eicar”; --no_case;)

F-SBID ( --name “eicar”; --protocol tcp; --service HTTP; --flow from_client; --pattern “www.eicar.org”; --no_case; --context host;)

Correct Answer: D

The correct custom IPS signature to block access to the website www.eicar.org should use the HTTP protocol with the context of the host, as this matches web traffic characteristics. Therefore, the appropriate configuration includes specifying TCP protocol, HTTP service, pattern for 'www.eicar.org' in a case-insensitive manner, and flow from the client. Hence, the correct option is a signature that fits these criteria.

Discussion

dstichtOption: D

It's not UDP and it's not "from_server", so D.

Disposable_Me_2018Option: D

It's not UDP (A or B). It's not DNS over TCP (C). Must be "D".

charrucoOption: D

D is correct