Home » Cisco » 210-260 v.2 » What is the primary purpose of a defined rule in an IPS?
What is the primary purpose of a defined rule in an IPS?
A. to configure an event action that takes place when a signature is triggered
B. to define a set of actions that occur when a specific user logs in to the system
C. to configure an event action that is pre-defined by the system administrator
D. to detect internal attacks
Correct Answer: A
Explanation/Reference:
Explanation:
You can choose from the following summarization options:
fire-all—Fires an alert each time the signature is triggered. If the threshold is set for summarization, alerts are fired for each execution until summarization occurs. After summarization starts, only one alert every summary interval fires
for each address set. Alerts for other address sets are either all seen or separately summarized. The signature reverts to fire all mode after a period of no alerts for that signature. summary—Fires an alert the first time a signature is triggered, and then additional alerts for that signature are summarized for the duration of the summary interval. Only one alert every summary interval should fire for each address set.
If the global summary threshold is reached, the signature goes into global summarization mode. global-summarization—Fires an alert for every summary interval. Signatures can be preconfigured for global summarization. fire-once—Fires an alert for each address set. You can upgrade this mode to global summarization mode.
Reference: http://www.cisco.com/c/en/us/td/docs/security/ips/7-0/configuration/guide/cli/cliguide7/cli_event_action_rules.html
