Which of the following does proper basic configuration of snort as a network intrusion detection system require?

The snort.conf file defines critical variables such as HOME_NET and EXTERNAL_NET, BPF capture filters, preprocessor settings, and which rule sets to load. By bounding what Snort captures and analyzes through the configuration file, the sensor focuses processing on traffic that matches your network scope and reduces false positives and resource waste.

Capturing every packet on the network segment without filtering is inefficient and floods Snort with irrelevant traffic, degrading performance and detection accuracy.

Limiting capture to a single segment is a network placement consideration, not a Snort configuration requirement, and does not address rule or filter configuration.

/var/log/snort is the default alert and log output directory, not a mechanism for limiting or defining packet capture scope.