You want to block access to the website www.eicar.org using a custom IPS signature.
Which custom IPS signature should you configure?
You want to block access to the website www.eicar.org using a custom IPS signature.
Which custom IPS signature should you configure?
The correct custom IPS signature to block access to the website www.eicar.org should use the HTTP protocol with the context of the host, as this matches web traffic characteristics. Therefore, the appropriate configuration includes specifying TCP protocol, HTTP service, pattern for 'www.eicar.org' in a case-insensitive manner, and flow from the client. Hence, the correct option is a signature that fits these criteria.
It's not UDP and it's not "from_server", so D.
It's not UDP (A or B). It's not DNS over TCP (C). Must be "D".
D is correct