Which of the following does proper basic configuration of snort as a network intrusion detection system require?

Snort uses its configuration file (snort.conf) to define the monitored network, active rule sets, preprocessors, and output plugins that collectively determine which packets are inspected and what actions are triggered. Basing capture behavior on the configuration file is fundamental to a controlled, rule-driven NIDS deployment and prevents wasting resources on irrelevant traffic.

Capturing every packet without rule-based filtering would overwhelm Snort's processing and generate excessive noise, defeating the purpose of a properly tuned NIDS.

Restricting capture to a single segment is a sensor placement consideration, not a Snort configuration file requirement.

/var/log/snort is the default output logging directory, not a mechanism for controlling which packets are captured or analyzed.