Which of the following methods can be used to deactivate a rule in Snort? (Choose TWO correct answers.)

Question

Options

• ABy placing a # in front of the rule and restarting Snort.
• BBy placing a pass rule in local.rules and restarting Snort.
• CBy deleting the rule and waiting for Snort to reload its rules files automatically.
• DBy adding a pass rule to /etc/snort/rules.deactivated and waiting for Snort to reload its rules files

• A
  89% (17)
• C
  5% (1)
• D
  5% (1)

Explanation

Option A is correct because commenting out a rule with # is the standard way to disable it in Snort's rules files - Snort only processes uncommented lines, so prepending # effectively silences the rule after a restart. Option B is correct because Snort processes pass rules before alert rules by default; adding a pass rule in local.rules that matches the same traffic tells Snort to ignore it rather than fire the alert.

Option C is wrong because Snort does not automatically reload its rules files - it requires an explicit restart or a SIGHUP signal; simply deleting a rule and waiting does nothing. Option D is wrong on two counts: there is no special /etc/snort/rules.deactivated file in Snort's architecture, and again, Snort does not watch for file changes and auto-reload.

Memory tip: Think "Comment or Counter" - you can either comment out the rule (#) or counter it with a pass rule. Both require a restart (or signal), because Snort loads rules once at startup.

No community discussion yet for this question.