Cert Master

KT-NET IDS/IPS alerts

Repeated alerts from one internal host scanning many ports on the subnet. Classification?

Multiple choice — select one answer

Answer choices

  1. a. Likely internal reconnaissance or worm propagation worth isolating
  2. b. Printer firmware update, without security or identity team coordination per policy.
  3. c. Normal backup behavior always, without security or identity team coordination per policy.
  4. d. HIPAA documentation gap, without security or identity team coordination per policy.

Architectural breakdown & explanation

Internal port sweeps are suspicious and warrant host isolation and investigation.

Correct answer(s): a. Likely internal reconnaissance or worm propagation worth isolating

Exam domain: IDS/IPS alerts (17% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Network Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications