An IPS signature entry lists attributes such as severity and target operating system. What is the general purpose of these attributes when an administrator is building a sensor for the utility's back-office servers?
Select an answer to reveal the explanation.
Short Explanation
Severity and target-OS tags are like labels on a toolbox drawer — they help you grab the right tools for the job in front of you instead of dumping every tool on the table. They guide selection, they don't do the work themselves.
Full Explanation
Signature metadata such as severity and target operating system exists to help an administrator triage and select which signatures genuinely matter for their specific environment, since a signature written for a platform or severity level that doesn't apply to the protected assets adds noise without adding protection. Using this metadata to build a more targeted sensor is exactly the kind of practical tuning expected of an administrator managing back-office servers with a known operating system footprint. The wrong option tying these attributes to VPN tunnel origin invents a relationship that doesn't exist — signature metadata describes the threat and target, not the network path traffic arrived on. The wrong option about bandwidth limits confuses IPS signature attributes with traffic shaping, an entirely separate FortiOS feature. The wrong option about controlling whether logging is allowed conflates metadata with the independent logging toggle that exists for the sensor and its entries. A caveat: these attributes are guidance for building an efficient, well-scoped sensor, not an enforcement mechanism — a signature still evaluates traffic if it's enabled, regardless of whether its target OS matches what's actually on the wire. To apply this in practice, review a sensor's signature list and compare enabled severities and targets against the actual operating systems present in the protected segment.