snort

What is Snort primarily used for?

• File compression

• Network intrusion detection and prevention

• Data backup

• Web hosting

What does the following Snort rule do? alert tcp any any -> 192.168.1.0/24 80 (msg:"Web traffic detected"; sid:100001;)

• Blocks HTTP traffic to the specified subnet

• Logs any UDP traffic to port 80

• Generates an alert for TCP traffic to port 80 in the specified subnet

• Drops packets to port 80

Which of the following is a valid protocol for Snort rules?

• TCP

• UDP

• ICMP

• All of the above

In Snort rules, what does content:"user-agent" signify?

• Specifies the sender of the packet

• Searches the packet content for the string "user-agent"

• Drops packets containing "user-agent"

• Generates an alert for any packet

What does the sid field in a Snort rule represent?

• A unique identifier for the rule

• The source IP address

• The destination port

• The action to be performed

Which operator is used in Snort rules to indicate traffic direction?

• :

• ->

• =>

• |

What is the purpose of the msg keyword in a Snort rule?

• Logs the packet source address

• Specifies the message to display in alerts

• Modifies the rule’s priority

• Filters out unnecessary packets

Which of the following keywords in a Snort rule is used to specify packet payload?

• content

• ttl

• dsize

• flags

You want to analyze network traffic to gain overall statistics and summaries without looking at individual packets. Which Traffic Analysis technique would be most suitable?

• Flow Analysis

• Packet Analysis

• Threat Hunting

• Network Forensics

What are the two sections of a Snort rule?

• header and options

• host and client

• internal and external

• action and process