nerdexam
EC-Council

312-50V11 · Question #20

You need a tool that can do network intrusion prevention and intrusion detection, function as a network sniffer, and record network activity. What tool would you most likely select?

The correct answer is A. Snort. Snort is a multi-function network security tool capable of intrusion detection, intrusion prevention, packet sniffing, and traffic logging. The other tools serve different primary purposes and lack this combined capability.

Sniffing

Question

You need a tool that can do network intrusion prevention and intrusion detection, function as a network sniffer, and record network activity. What tool would you most likely select?

Options

  • ASnort
  • BNmap
  • CCain & Abel
  • DNessus

How the community answered

(31 responses)
  • A
    87% (27)
  • B
    3% (1)
  • C
    6% (2)
  • D
    3% (1)

Why each option

Snort is a multi-function network security tool capable of intrusion detection, intrusion prevention, packet sniffing, and traffic logging. The other tools serve different primary purposes and lack this combined capability.

ASnortCorrect

Snort is an open-source network-based intrusion detection and prevention system (NIDS/NIPS) that operates in three modes: sniffer, packet logger, and network intrusion detection/prevention. It uses rule-based analysis to inspect traffic in real time and can log packets for later review, making it the only tool in the list that satisfies all four stated requirements simultaneously.

BNmap

Nmap is a port scanner and network discovery tool, not an IDS/IPS or packet logger.

CCain & Abel

Cain and Abel is primarily a Windows password recovery and credential-cracking tool, not a network IDS/IPS.

DNessus

Nessus is a vulnerability scanner used for host-based assessments, not for intrusion detection or packet capture.

Concept tested: Snort IDS/IPS and packet sniffing capabilities

Source: https://www.snort.org/documents

Topics

#Snort#IDS#network sniffer#intrusion detection

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice