Cert Master

KT-NET IDS/IPS alerts

IPS blocks legitimate ERP traffic after a signature update. BEST immediate step?

Multiple choice — select one answer

Answer choices

  1. a. Disable IPS permanently, using shared credentials instead of individual accountability.
  2. b. Turn off logging on IPS, without security or identity team coordination per policy.
  3. c. Block all ERP users, using shared credentials instead of individual accountability.
  4. d. Tune or temporarily disable the specific signature with change control and monitor ERP

Architectural breakdown & explanation

Signature tuning balances protection and availability; document changes.

Correct answer(s): d. Tune or temporarily disable the specific signature with change control and monitor ERP

Exam domain: IDS/IPS alerts (17% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Network Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications