SCP Exam SC0-451 Topic 5 Question 83 Discussion

Actual exam question for SCP's SC0-451 exam

Question #: 83
Topic #: 5

You are configuring your new IDS machine, and are creating new rules. You enter the following rule: Alert tcp any any -> 10.0.10.0/24 any (msg: "NULL scan detected"; flags: 0;) What is the effect of this rule?

AThis is a logging rule, designed to capture NULL scans originating from the 10.0.10.0/24 network.

BThis is a logging rule, designed to capture NULL scans.

CThis is an alert rule, designed to notify you of NULL scans of the network in either direction.

DThis is an alert rule, designed to notify you of NULL scans of the network in one direction.

EThis is a logging rule, designed to notify you of NULL scans.

Show Suggested Answer

Suggested Answer: D

by Alesia at Mar 19, 2024, 01:21 AM

Limited Time Offer

25%

Off

Get Premium SC0-451 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Bo

7 months ago

That makes sense. It would help us track down the source.

upvoted 0 times

...

Johana

7 months ago

I believe it's for one direction only.

upvoted 0 times

...

Mila

7 months ago

But is it for both directions or just one?

upvoted 0 times

...

Bo

7 months ago

I agree. It is designed to notify us of NULL scans on the network.

upvoted 0 times

...

Johana

8 months ago

I think the rule in the question is an alert rule.

upvoted 0 times

...

Veta

8 months ago

So, it could be option C then, an alert rule for NULL scans of the network in either direction.

upvoted 0 times

...

Candida

8 months ago

That makes sense, it could be for capturing NULL scans coming from and going to the network.

upvoted 0 times

...

Micheline

8 months ago

I'm not sure, but I think it could be an alert rule for NULL scans in both directions.

upvoted 0 times

...

Veta

8 months ago

I believe it is a logging rule specific to NULL scans from the 10.0.10.0/24 network.

upvoted 0 times

...

Candida

8 months ago

I think the effect of this rule is to notify us of NULL scans in the network.

upvoted 0 times

...