hardMultiple ChoiceObjective-mapped
200-201 Practice Question: An IPS sensor is configured inline and drops…
An IPS sensor is configured inline and drops traffic that triggers the signature 'OVERFLOW-ICMP-ECHO', which triggers on ICMP packets with size > 1024 bytes. A network administrator reports that legitimate network monitoring tools using large ICMP packets are being blocked. What is the best course of action?
⚠ Common exam trap
Cisco often tests the misconception that you should adjust the signature threshold (option A) to fix false positives, but the correct approach is to use a whitelist or exception rule to allow known legitimate traffic without weakening the overall security posture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a whitelist for the monitoring tool's source IP
Creating a whitelist for the monitoring tool's source IP allows the IPS to continue dropping malicious oversized ICMP packets while permitting legitimate traffic from known, trusted sources. This maintains security for the rest of the network without disabling the signature or changing its mode, which would reduce protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the threshold to 2048
Why it's wrong here
Increasing the threshold may still not accommodate all legitimate tools and reduces detection.
- ✓
Create a whitelist for the monitoring tool's source IP
Why this is correct
A whitelist permits specific IPs to bypass the signature while keeping detection for others.
- ✗
Disable the signature entirely
Why it's wrong here
Disabling removes protection against ICMP overflow attacks.
- ✗
Change the sensor mode to IDS for that signature
Why it's wrong here
Changing to IDS mode would generate alerts but still block traffic? Actually inline IDS mode is not typical; if sensor is inline, changing to alert only may still drop? Better to whitelist.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.