nerdexam
EC-Council

312-50V11 · Question #316

Which of the following identifies the three modes in which Snort can be configured to run?

The correct answer is A. Sniffer, Packet Logger, and Network Intrusion Detection System. Snort operates in three distinct modes: Sniffer (displays packets), Packet Logger (saves packets to disk), and NIDS (analyzes traffic against rules).

Evading IDS, Firewalls, and Honeypots

Question

Which of the following identifies the three modes in which Snort can be configured to run?

Options

  • ASniffer, Packet Logger, and Network Intrusion Detection System
  • BSniffer, Network Intrusion Detection System, and Host Intrusion Detection System
  • CSniffer, Host Intrusion Prevention System, and Network Intrusion Prevention System
  • DSniffer, Packet Logger, and Host Intrusion Prevention System

How the community answered

(50 responses)
  • A
    92% (46)
  • B
    2% (1)
  • C
    4% (2)
  • D
    2% (1)

Why each option

Snort operates in three distinct modes: Sniffer (displays packets), Packet Logger (saves packets to disk), and NIDS (analyzes traffic against rules).

ASniffer, Packet Logger, and Network Intrusion Detection SystemCorrect

Snort's official documentation defines exactly three operational modes - Sniffer mode reads and displays network packets in real time, Packet Logger mode captures and writes packets to disk for later analysis, and Network Intrusion Detection System (NIDS) mode applies rule-based analysis to traffic and generates alerts. These three modes represent the core architecture of Snort as described in its design documentation.

BSniffer, Network Intrusion Detection System, and Host Intrusion Detection System

Snort does not include a Host Intrusion Detection System (HIDS) mode; HIDS is a separate product category and not a built-in Snort operational mode.

CSniffer, Host Intrusion Prevention System, and Network Intrusion Prevention System

Snort does not have a Host Intrusion Prevention System mode or a Network Intrusion Prevention System mode as its three defined run modes; IPS functionality is a separate consideration beyond the three base modes.

DSniffer, Packet Logger, and Host Intrusion Prevention System

Host Intrusion Prevention System is not one of Snort's three defined operational modes; the third mode is NIDS, not HIPS.

Concept tested: Snort IDS operational modes configuration

Source: https://www.snort.org/documents/snort-users-manual

Topics

#Snort#IDS modes#packet logger#network intrusion detection

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice