350-701 Network Security Practice Question
An engineer is tuning an IPS on a Cisco FTD to reduce false positives. Which three techniques are effective? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add source and destination IP filters to signatures
Tuning to reduce false positives includes adjusting thresholds, disabling specific signatures, using rule filtering by source/destination, and customizing rules. Monitoring without dropping (monitor mode) also helps evaluate impact.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add source and destination IP filters to signatures
Why this is correct
Restricting rule scope reduces irrelevant alerts.
- ✓
Disable specific signatures that trigger incorrectly
Why this is correct
Directly removes the source of false positives.
- ✗
Increase the global sensitivity slider to maximum
Why it's wrong here
Increasing sensitivity typically increases false positives.
- ✗
Enable all built-in rules to maximize coverage
Why it's wrong here
Enabling all rules increases false positives and noise.
- ✓
Use monitor mode for new or modified rules
Why this is correct
Monitor mode allows observation without blocking, helping to assess false positives.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.