mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: Refer to the exhibit
Exhibit
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Possible SQL Injection"; content:"SELECT"; nocase; content:"FROM"; distance:0; within:10; classtype:web-application-attack; sid:1000001; rev:1;)
Refer to the exhibit. An analyst sees many alerts from this IDS rule. What is a likely cause?
⚠ Common exam trap
ISC2 often tests the distinction between a rule triggering due to actual malicious activity versus poor rule design, and the trap here is assuming that many alerts always indicate a real attack (like SQL injection scanning) rather than considering signature quality issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The rule is poorly written generating false positives
The IDS rule is likely generating excessive alerts due to poor signature design, such as using overly broad content matches or lacking proper contextual filters. Without the 'flow' keyword to establish session state (e.g., 'to_server, established'), the rule may trigger on any packet containing the SQL pattern, including non-exploit traffic like error messages or benign queries, resulting in false positives.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A web application is vulnerable to SQL injection
Why it's wrong here
The rule is not precise enough to confirm an actual vulnerability.
- ✗
An attacker is scanning for SQL injection
Why it's wrong here
While possible, it's not the most likely cause of many alerts.
- ✗
The rule is missing the "flow" keyword
Why it's wrong here
Missing 'flow' might affect performance but not cause many alerts.
- ✓
The rule is poorly written generating false positives
Why this is correct
The rule matches common SQL keywords in normal traffic, causing false positives.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Design
Key term
IDS
An IDS is a security system that monitors network or system traffic for suspicious activity and alerts administrators to potential threats, but does not actively block them.
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.