mediumMultiple Choice
200-201 A company uses Snort for intrusion detection Practice Question
A company uses Snort for intrusion detection. The analyst receives an alert for 'ET POLICY Outgoing DNS Query to Possible Malicious Domain'. The destination IP is 203.0.113.5. The analyst checks the DNS query and finds it is for 'update.software.com', which is a legitimate update server. However, the Snort rule triggered because the domain was recently added to a threat intelligence feed. What is the most likely cause of this false positive?
⚠ Common exam trap
Cisco often tests the distinction between a false positive caused by a rule or signature issue versus a false positive caused by inaccurate threat intelligence, leading candidates to incorrectly blame the rule configuration or signature specificity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The threat intelligence feed contains a false positive for that domain
The Snort rule triggered because the domain 'update.software.com' was listed in a threat intelligence feed, but the analyst verified it is a legitimate update server. This indicates the threat intelligence feed itself incorrectly flagged the domain as malicious, making it a false positive in the feed. Option D is correct because the root cause is the feed's inaccuracy, not a misconfiguration or overly broad rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Snort rule is misconfigured and should be disabled
Why it's wrong here
Disabling the rule removes detection of genuinely malicious DNS queries matching that signature, and the rule itself parsed the packet correctly. Disabling is warranted only when a signature produces persistent noise with no tuning path, not for a single reputation-based match.
- ✗
The rule is too broad and matches all DNS queries
Why it's wrong here
The rule matched one specific domain from a threat intelligence feed, so it is not matching all DNS queries. Broad-match rules require narrowing to specific ports, flags or payload strings; here the trigger is the feed entry, not rule breadth.
- ✗
The Snort signature is too generic and should be tuned
Why it's wrong here
The signature matched a domain newly added to a threat intelligence feed, not a generic pattern, so tuning its content would not address the feed-driven trigger. Tuning suits rules that fire on broad protocol patterns rather than on reputation data.
- ✓
The threat intelligence feed contains a false positive for that domain
Why this is correct
The Snort rule fired solely because the domain appeared in a threat intelligence feed, and the domain is genuinely a legitimate update server. The feed therefore contains an inaccurate entry for that domain, which is the false positive cause rather than any DNS or rule syntax error.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.