Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Ficha Técnica descarregar pdf (Página 46)

642-531

creating custom signatures with IDS MC? (Choose two.)

A. SubSigID

B. signature name

C. engine description

D. engine name

E. signature string

Answer: B, D

The two required fields are Signature Name & Engine

Reference:

Cisco Courseware 14-33

Page 365 Cisco Press CCSP CSIDS 2nd edition under Creating Custom Signatures

See screenshot, fields marked with * are required.

* Signature name

* Engine

QUESTION 105

Which TCP session reassembly configuration parameter enforces that a valid TCP session be establish before

the Cisco IDS Sensor's sensing engine analyzes the traffic associated with the session?

A. TCP open establish timeout

B. TCP embryonic timeout

C. TCP closed timeout

D. TCP three way handshake

E. TCP sequence timeout

Answer: D

Explanation:

The goal of defining these reassembly settings is to ensure that the sensor does not allocate all of its resources

to datagrams that cannot be completely reconstructed, either because the sensor missed some frame

transmissions or because an attack is generating random fragmented datagrams.

To specify that the sensor track only sessions for which the three-way handshake is completed, select the TCP

Three Way Handshake check box.

Reference: Tuning Sensor Configurations

QUESTION 106