300-710 · Question #290
An engineer is configuring a custom intrusion rule on Cisco FMC. The engineer needs the rule to search the payload or stream for the string "|44 78 97 13 2 0A|". Which keyword must the engineer use…
The correct answer is B. content. To search for a specific hexadecimal string within the payload or stream when configuring a custom intrusion rule on Cisco FMC, the "content" keyword is the correct argument for packet inspection.
Question
An engineer is configuring a custom intrusion rule on Cisco FMC. The engineer needs the rule to search the payload or stream for the string "|44 78 97 13 2 0A|". Which keyword must the engineer use with this string to create an argument for packet inspection?
Options
- Aprotected_content
- Bcontent
- Cdata
- Dmetadata
How the community answered
(29 responses)- A7% (2)
- B86% (25)
- C3% (1)
- D3% (1)
Why each option
To search for a specific hexadecimal string within the payload or stream when configuring a custom intrusion rule on Cisco FMC, the "content" keyword is the correct argument for packet inspection.
`protected_content` is not a standard Snort rule keyword for searching within the payload.
In Snort rules, the `content` keyword is used to search for specific data patterns or strings within the packet payload or TCP stream. The string is typically represented in hexadecimal format, enclosed in pipes, exactly as shown in the question, making `content` the appropriate keyword for this type of pattern matching.
`data` is not a standard Snort rule keyword used in this context for searching for specific patterns in the payload.
`metadata` in Snort rules refers to information about the rule itself, such as its ID, severity, or associated CVEs, not the actual packet content.
Concept tested: Snort rule content matching keyword
Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/snort_best_practices/snort_best_practices_book/Snort_Rules.html
Topics
Community Discussion
No community discussion yet for this question.