Snort Usage Quiz

What is Snort primarily used for?

• File compression

• Network intrusion detection and prevention

• Data backup

• Web hosting

In Snort, which keyword is used to define the action a rule should take?

• alert

• log

• pass

• All of the above

What does the following Snort rule do? alert tcp any any -> 192.168.1.0/24 80 (msg:"Web traffic detected"; sid:100001;)

• Blocks HTTP traffic to the specified subnet

• Logs any UDP traffic to port 80

• Generates an alert for TCP traffic to port 80 in the specified subnet

• Drops packets to port 80

Which of the following is a valid protocol for Snort rules?

• TCP

• UDP

• ICMP

• All of the above

In Snort rules, what does content:"user-agent" signify?

• Specifies the sender of the packet

• Searches the packet content for the string "user-agent"

• Drops packets containing "user-agent"

• Generates an alert for any packet

What does the sid field in a Snort rule represent?

• A unique identifier for the rule

• The source IP address

• The destination port

• The action to be performed

Which operator is used in Snort rules to indicate traffic direction?

• :

• ->

• =>

• |

What is the purpose of the msg keyword in a Snort rule?

• Logs the packet source address

• Specifies the message to display in alerts

• Modifies the rule’s priority

• Filters out unnecessary packets

What type of Snort rule does the keyword pass represent?

• An alert rule

• A rule to log packets

• A rule to ignore matching packets

• A rule to drop packets

Which of the following keywords in a Snort rule is used to specify packet payload?

• content

• ttl

• dsize

• flags