642-533 IPS exam Simulation answers

图书介绍

I've just finished the IPS exams with 988 score and I would like to share these answers with you


A- CLI based sim
sensor# show events alert high 18:00 may 11 2007
sensor# show config
sensor# config t
sensor(config)#default service signature-definition sig0
sensor#show config
sensor#copy current-config backup-config


B- GUI based Sim
1. Choose Configuration->Policies->Event Action Rules->rules0->Event Action Overrides
2. Check Use Event Action Override box
3. Choose Target Value Rating
4. Delete all
5. Add: there choose Mission Critical, range of IP addresses 172.16.1.3-172.16.1.4
6. Click OK, then Apply
7. Go to Event Action tab
8. Delete all
9. Add Deny Packet Inline for the range of 80 to 100 (Minimum and Maximum fields). Enabled and Active should be true.
10. OK and Apply
11. Now go to rules0-> Event Action Filters and Add new one
12. Enter filter name - for example, PermitMS
13. Change Attacker Address field to 10.0.1.12
14. Change Victim destination addresses to 172.16.1.3-172.16.1.4
15. Choose Deny Packet Inline from the actions to subtract
16. OK and Apply