200-201 Security Monitoring Practice Question
A security analyst is tuning a Snort IDS to reduce false positives. Which TWO Snort rule options should the analyst modify to make the rule more specific?
⚠ Common exam trap
Cisco often tests the misconception that increasing the 'priority' value makes a rule more important or specific, when in fact a lower numeric value (e.g., 1) indicates higher priority, and changing it does not affect rule specificity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set a 'threshold' to limit the number of alerts per time window
Setting a 'threshold' in Snort limits the number of alerts generated for a given rule within a specified time window, which directly reduces false positives by suppressing repeated alerts from benign traffic that matches the rule pattern. Option D is correct because adding a 'content' field forces the rule to match specific bytes in the packet payload, making the rule more precise and less likely to trigger on unrelated traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the 'destination port' field
Why it's wrong here
Removing constraints makes the rule broader, increasing false positives.
- ✓
Set a 'threshold' to limit the number of alerts per time window
Why this is correct
Threshold reduces repeated alerts from the same source.
- ✗
Increase the 'priority' value
Why it's wrong here
Priority affects alert severity, not specificity.
- ✓
Add a 'content' field to match specific bytes
Why this is correct
Content matching narrows the rule to specific payloads.
- ✗
Change the action from 'alert' to 'log'
Why it's wrong here
Action type does not affect false positives.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.