GSEC Defensible Network Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Deploy an anomaly-based IDS with a baseline that includes the weekly scanner, and alert only when traffic deviates from that baseline.

  Why it's wrong here

  Anomaly detection could suppress the weekly scan, but it cannot reliably distinguish a stealthy attacker scanning from the trusted scanner, because both produce similar deviations from the baseline. The requirement is to detect reconnaissance without false positives from one known host, which is better solved by identity-based pass rules than by statistical baselining that blurs the distinction.

• ✗

  Deploy a signature-based IDS and disable all scan-detection signatures, relying on firewall logs to reveal reconnaissance activity.

  Why it's wrong here

  Disabling scan signatures eliminates the very detection the design requires; firewall logs show permitted or denied connections but not the breadth and pattern of probes across many ports that characterize reconnaissance. The authorized scanner would certainly not alert, but neither would a real attacker, so the architecture would fail its core objective of detecting scanning against the research subnet.

• ✓

  Deploy a signature-based IDS tuned to scan signatures and configure a pass rule for the authorized scanner's IP address above the scan-detection rules.

  Why this is correct

  A pass rule placed before the detection signatures tells the sensor to ignore traffic from the trusted scanner, while scan-detection signatures still fire for any other source probing the research subnet. This preserves visibility of real reconnaissance and suppresses the known benign weekly scan, which is precisely the tuning the requirement demands on a SPAN-based sensor.

• ✗

  Deploy a signature-based IDS and configure a suppression threshold that ignores any source generating more than one hundred alerts per hour.

  Why it's wrong here

  Threshold suppression is not identity-aware, so a fast, noisy scan from an attacker would be silenced just as the weekly scanner is. Worse, a slow scan below the threshold would still alert, inverting the intent. The requirement is to exempt one known host, not to blind the sensor to high-volume events, which are often the most important to investigate.