CND Network Attacks And Defense Strategies Practice Question
A company's intrusion detection system (IDS) flags multiple suspicious packets containing shellcode signatures destined for an internal database server. However, the security team determines that the application was updated and the traffic was a false positive. Which action should the security analyst take within the Snort configuration to prevent this specific signature from generating future alerts?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the Snort rule configuration file to add a 'suppress' rule specifying the event signature ID and target IP.
In Snort, the suppress rule configuration allows administrators to suppress specific alerts for specific IP addresses or subnets without completely disabling the signature rule globally. Alternatively, modifying rules using threshold or classification is used, but suppress is the direct action for silencing false positives.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the rule definition entirely from the Snort local rules file.
Why it's wrong here
Deleting the rule entirely removes protection against actual attacks matching that signature.
- ✓
Modify the Snort rule configuration file to add a 'suppress' rule specifying the event signature ID and target IP.
Why this is correct
A suppress rule silences specific IDS alerts for designated hosts without disabling the entire rule.
- ✗
Disable all preprocessor inspection engines within the snort.conf configuration file.
Why it's wrong here
Disabling preprocessors blinds the IDS to protocol-anomaly and fragmentation attacks.
- ✗
Change the sensor mode from inline IPS mode to passive IDS sniffing mode.
Why it's wrong here
Switching to passive mode prevents packet dropping, but still generates unwanted log alerts.
Visual reference
About these practice questions
One of 323 original CND practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.