Certified Ethical Hacker Version 11 (CEHv11) Practice Test

Reputation-based filtering uses threat intelligence to classify IP addresses and other sources as known threats. In a security framework, evaluating whether an IP or service is a threat source lets the system block or limit traffic from that source before it reaches sensitive resources. Cisco IPS Source IP Reputation Filtering does this directly by consulting threat-intelligence feeds to mark certain source IPs as malicious or suspicious and enforce blocking or restrictions accordingly, reducing exposure from compromised hosts, botnets, or scanners. RFC 3704 Filtering is about preventing spoofed addresses by ensuring packets have believable source addresses, not about judging whether the source itself is harmful. Traffic Pattern Analysis examines how traffic behaves to spot anomalies, which helps detect potential threats but doesn’t inherently tag a source as a threat by reputation. Event Log Analysis involves reviewing logs to detect and investigate incidents after they occur, rather than proactively identifying threat sources at the entry point.