Question 236 of 507

Network Intrusion Analysis →mediumMultiple ChoiceObjective-mapped

Quick Answer

The answer is to create a custom Suricata pass rule that excludes traffic from the specific IP address of the scanning tool. This is correct because a pass rule tells Suricata to stop processing traffic from that source against the default rule set, directly reducing false positives from the legitimate self-signed certificate and TLS renegotiation alerts without disabling broader detection. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your understanding of Suricata rule actions—specifically the difference between a drop, reject, alert, and pass rule—and how to surgically tune an IDS to maintain visibility while eliminating noise. A common trap is to disable the entire SSL/TLS rule group, which would blind the IDS to real threats; instead, the pass rule preserves monitoring for all other hosts. Memory tip: think of a pass rule as a VIP pass—it lets the known good source skip the line of alerts while everyone else still gets checked.

200-201 Network Intrusion Analysis Practice Question

This 200-201 practice question tests your understanding of network intrusion analysis. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

Your organization recently deployed a new web application that uses HTTPS. The security team notices that the IDS is generating a large number of alerts for 'SSL/TLS handshake anomalies' and 'self-signed certificates'. After investigating, you find that many of these alerts are coming from a legitimate internal scanning tool that uses a self-signed certificate. The IDS also reports a high rate of 'TLS renegotiation' attempts from the same source. The CISO wants to reduce false positives while maintaining visibility. The IDS is based on Suricata and uses a default rule set. What is the best course of action?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

Question 1mediummultiple choice

Full question →

A
Create a custom Suricata pass rule that excludes traffic from the specific IP address of the scanning tool.
This precisely reduces false positives from a known source while keeping detection for others.
B
Add a whitelist rule that ignores any traffic from any host using self-signed certificates.
Why wrong: Attackers can also use self-signed certificates; blanket whitelisting is dangerous.
C
Disable the Suricata rules that match self-signed certificates and TLS renegotiation.
Why wrong: This would suppress alerts for all traffic, missing potential real attacks using those techniques.
D
Recommend removing the scanning tool from the network and using a different tool that uses a trusted certificate.
Why wrong: Replacing the tool may be costly and unnecessary; tuning is more efficient.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a custom Suricata pass rule that excludes traffic from the specific IP address of the scanning tool.

Option A is correct because creating a custom Suricata pass rule for the specific IP address of the legitimate scanning tool will suppress alerts for that known source while maintaining full visibility into all other traffic. This approach reduces false positives without disabling broader security monitoring, as the IDS continues to inspect and alert on SSL/TLS anomalies and self-signed certificates from all other hosts.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Create a custom Suricata pass rule that excludes traffic from the specific IP address of the scanning tool.
Why this is correct
This precisely reduces false positives from a known source while keeping detection for others.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Add a whitelist rule that ignores any traffic from any host using self-signed certificates.
Why it's wrong here
Attackers can also use self-signed certificates; blanket whitelisting is dangerous.
✗
Disable the Suricata rules that match self-signed certificates and TLS renegotiation.
Why it's wrong here
This would suppress alerts for all traffic, missing potential real attacks using those techniques.
✗
Recommend removing the scanning tool from the network and using a different tool that uses a trusted certificate.
Why it's wrong here
Replacing the tool may be costly and unnecessary; tuning is more efficient.

Common exam traps

Common exam trap: answer the scenario, not the keyword

Cisco often tests the distinction between a targeted exclusion (like a pass rule for a specific IP) and a broad configuration change (like disabling rules or whitelisting entire categories), where candidates mistakenly choose the latter because they think it is simpler, not realizing it sacrifices security visibility.

Detailed technical explanation

How to think about this question

Suricata's pass rules use the 'pass' action in the rule header to explicitly allow traffic matching specific criteria (e.g., source IP, destination port) to bypass further inspection and alerting. This is distinct from a 'drop' or 'reject' rule and is processed before other rules in the default rule set, ensuring that only the targeted traffic is excluded. In real-world deployments, internal scanning tools often use self-signed certificates for cost or simplicity, and a pass rule with a narrow scope (e.g., 'pass tcp $SCANNER_IP any -> any any (msg:"Skip scanner"; sid:1000001;)') is the standard method to handle such false positives without compromising overall detection.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A practitioner preparing for the 200-201 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related 200-201 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Security Policies and Procedures practice questions

Practise 200-201 questions linked to Security Policies and Procedures.

Security Concepts practice questions

Practise 200-201 questions linked to Security Concepts.

Security Monitoring practice questions

Practise 200-201 questions linked to Security Monitoring.

Host-Based Analysis practice questions

Practise 200-201 questions linked to Host-Based Analysis.

Network Intrusion Analysis practice questions

Practise 200-201 questions linked to Network Intrusion Analysis.

200-201 fundamentals practice questions

Practise 200-201 questions linked to 200-201 fundamentals.

200-201 scenario practice questions

Practise 200-201 questions linked to 200-201 scenario.

200-201 troubleshooting practice questions

Practise 200-201 questions linked to 200-201 troubleshooting.

Practice this exam

Start a free 200-201 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

200-201 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this 200-201 question test?

Network Intrusion Analysis — This question tests Network Intrusion Analysis — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Create a custom Suricata pass rule that excludes traffic from the specific IP address of the scanning tool. — Option A is correct because creating a custom Suricata pass rule for the specific IP address of the legitimate scanning tool will suppress alerts for that known source while maintaining full visibility into all other traffic. This approach reduces false positives without disabling broader security monitoring, as the IDS continues to inspect and alert on SSL/TLS anomalies and self-signed certificates from all other hosts.

What should I do if I get this 200-201 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.