mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: Your organization recently deployed a new web…
Your organization recently deployed a new web application that uses HTTPS. The security team notices that the IDS is generating a large number of alerts for 'SSL/TLS handshake anomalies' and 'self-signed certificates'. After investigating, you find that many of these alerts are coming from a legitimate internal scanning tool that uses a self-signed certificate. The IDS also reports a high rate of 'TLS renegotiation' attempts from the same source. The CISO wants to reduce false positives while maintaining visibility. The IDS is based on Suricata and uses a default rule set. What is the best course of action?
⚠ Common exam trap
Cisco often tests the distinction between a targeted exclusion (like a pass rule for a specific IP) and a broad configuration change (like disabling rules or whitelisting entire categories), where candidates mistakenly choose the latter because they think it is simpler, not realizing it sacrifices security visibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom Suricata pass rule that excludes traffic from the specific IP address of the scanning tool.
Creating a custom Suricata pass rule for the specific IP address of the legitimate scanning tool will suppress alerts for that known source while maintaining full visibility into all other traffic. This approach reduces false positives without disabling broader security monitoring, as the IDS continues to inspect and alert on SSL/TLS anomalies and self-signed certificates from all other hosts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a custom Suricata pass rule that excludes traffic from the specific IP address of the scanning tool.
Why this is correct
This precisely reduces false positives from a known source while keeping detection for others.
- ✗
Add a whitelist rule that ignores any traffic from any host using self-signed certificates.
Why it's wrong here
Attackers can also use self-signed certificates; blanket whitelisting is dangerous.
- ✗
Disable the Suricata rules that match self-signed certificates and TLS renegotiation.
Why it's wrong here
This would suppress alerts for all traffic, missing potential real attacks using those techniques.
- ✗
Recommend removing the scanning tool from the network and using a different tool that uses a trusted certificate.
Why it's wrong here
Removing the scanning tool fails to address the root cause: the IDS lacks an exception rule to suppress alerts for the legitimate scanner’s self-signed certificate and renegotiation behaviour. The CISO’s goal is to reduce false positives while maintaining visibility, not to eliminate the tool. This option is tempting because replacing a non-compliant tool with one using a trusted certificate would normally resolve certificate-related alerts, but it ignores the need to tune the detection engine for authorised internal traffic.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.