312-50V10 · Question #747
You just set up a security system in your network. In what kind of system would you find the following string of characters used as a rule within its configuration? alert tcp any any ->192.168.100.0/2
The correct answer is D. An Intrusion Detection System. The string shown is a Snort IDS rule, identifiable by its 'alert' action, protocol, IP/port syntax, and message option enclosed in parentheses.
Question
You just set up a security system in your network. In what kind of system would you find the following string of characters used as a rule within its configuration? alert tcp any any ->192.168.100.0/24 21 (msg:""FTP on the network!"";)
Options
- Aa firewall IPTable
- BFTP Server rule
- CA Router IPTable
- DAn Intrusion Detection System
How the community answered
(48 responses)- B2% (1)
- C4% (2)
- D94% (45)
Why each option
The string shown is a Snort IDS rule, identifiable by its 'alert' action, protocol, IP/port syntax, and message option enclosed in parentheses.
Linux iptables firewall rules use a completely different syntax based on chains, targets, and match modules (e.g., -A INPUT -p tcp --dport 21 -j ACCEPT).
FTP servers do not use rule-based configuration files with alert actions and network CIDR notation for traffic inspection.
Router ACL or iptables configurations use vendor-specific syntax that does not include the 'alert' keyword or Snort-style option parentheses.
Snort is a widely used open-source Intrusion Detection System whose rules follow the exact syntax shown: action (alert), protocol (tcp), source address/port (any any), direction (->), destination network and port (192.168.100.0/24 21), and rule options in parentheses including msg. This rule would trigger an alert whenever TCP traffic destined for port 21 (FTP) is detected on the specified subnet. No other listed system type uses this rule format.
Concept tested: Snort IDS rule syntax identification
Source: https://docs.snort.org/rules/headers
Topics
Community Discussion
No community discussion yet for this question.