mediumMultiple ChoiceObjective-mapped
200-201 A company uses Snort for intrusion detection Practice Question
A company uses Snort for intrusion detection. The analyst receives an alert for 'ET POLICY Outgoing DNS Query to Possible Malicious Domain'. The destination IP is 203.0.113.5. The analyst checks the DNS query and finds it is for 'update.software.com', which is a legitimate update server. However, the Snort rule triggered because the domain was recently added to a threat intelligence feed. What is the most likely cause of this false positive?
⚠ Common exam trap
Cisco often tests the distinction between a false positive caused by a rule or signature issue versus a false positive caused by inaccurate threat intelligence, leading candidates to incorrectly blame the rule configuration or signature specificity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The threat intelligence feed contains a false positive for that domain
The Snort rule triggered because the domain 'update.software.com' was listed in a threat intelligence feed, but the analyst verified it is a legitimate update server. This indicates the threat intelligence feed itself incorrectly flagged the domain as malicious, making it a false positive in the feed. Option D is correct because the root cause is the feed's inaccuracy, not a misconfiguration or overly broad rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Snort rule is misconfigured and should be disabled
Why it's wrong here
The rule correctly matched the domain; the issue is with the threat feed, not the rule configuration.
- ✗
The rule is too broad and matches all DNS queries
Why it's wrong here
The rule only triggers on specific domains listed in the threat feed, not all DNS queries.
- ✗
The Snort signature is too generic and should be tuned
Why it's wrong here
The signature is specific to a domain; the problem is the feed data quality.
- ✓
The threat intelligence feed contains a false positive for that domain
Why this is correct
The domain is legitimate but was erroneously flagged by the threat feed, causing a false positive alert.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.