ccna 5 pt exam

ccna 5 pt exam.5.241 Feature behaviorWhenever a feature detects a configured behavior, the feature triggers one or more behaviors. There are multiple behaviors that can be triggered. Generate an alert. Log the behavior. Discard or block this behavior.Reset the TCP connection.Block subsequent (future) behaviors. Allow the behavior. The behaviors that can be applied depend on the type and platform of the feature.5.2.4.2 Generating a Glance ReportMonitoring alerts generated by network-based and host-based IPS systems is necessary to understand the network attacks that are occurring. If an attacker initiates a flood of forged alerts, then examining these alerts can lead to security analysis overload. Both network- and host-based IPS solutions combine both alert types. Together, they enable administrators to effectively monitor the operation of the network: atomic alerts and aggregate alerts. Understanding these alert types is critical to "providing more effective network protection.Atomic AlertsAtomic alerts are generated with every feature trigger. In some cases, this behavior is not useful and can indicate the occurrence of all specific attacks. However, an attacker can generate a flood of alerts to a monitoring station by generating several false alerts to an IPS device or application.Aggregate glance reports are used as a replacement for generating alerts for each signature event. Some IPS solutions enable administrators to generate aggregate alerts. An aggregate alert is a single... alert that indicates the presence of the same feature from the same - source address or end 11 name. The alert aggregation model limits the number of alerts generated and makes it difficult for an attacker to consume sensor I... s resources. Using the aggregation mode, when the behavior of a matching feature is found within a specific time period, the administrator also receives a message related to the number of matches. When making the Kaw glance report aggregation, the intrusion act... The first . number of instances will send a normal alert. Subsequently, other instances of the same behavior (repeated alerts) are counted continuously during the aggregation interval of the feature until the time is up. When the length of time defined by the aggregation interval is consumed, a summary alarm is issued, indicating the number of alarms issued during this time period. Some IPS solutions enable [dynamic aggregation] even when the default behavior is to produce atomic glance reports. Some IPS solutions also enable [dynamic aggregation. In this case, if the number of original glances exceeds the number of allotted values within the specified time, the feature automatically switches to generating an aggregate alarm instead of the original alarm. After the defined time has elapsed, the feature mows back to its initial configuration. Automatic aggregation enables administrators to automatically call132 Chapter 5 Implementing Intrusion Prevention