nerdexam
EC-Council

312-50V11 · Question #747

You just set up a security system in your network. In what kind of system would you find the following string of characters used as a rule within its configuration? alert tcp any any ->192.168.100.0/2

The correct answer is D. An Intrusion Detection System. The rule string shown is written in Snort IDS syntax, which uses a structured format of action, protocol, addresses, ports, and options to alert on specific network traffic patterns.

Evading IDS, Firewalls, and Honeypots

Question

You just set up a security system in your network. In what kind of system would you find the following string of characters used as a rule within its configuration? alert tcp any any ->192.168.100.0/24 21 (msg:""FTP on the network!"";)

Options

  • Aa firewall IPTable
  • BFTP Server rule
  • CA Router IPTable
  • DAn Intrusion Detection System

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    4% (1)
  • D
    92% (24)

Why each option

The rule string shown is written in Snort IDS syntax, which uses a structured format of action, protocol, addresses, ports, and options to alert on specific network traffic patterns.

Aa firewall IPTable

Firewall iptables rules use a different syntax structured around chains and targets, such as '-A INPUT -p tcp --dport 21 -j DROP', and do not use the alert keyword or msg option.

BFTP Server rule

FTP servers control access through user authentication and configuration files, not through alert-based rule strings in this format.

CA Router IPTable

Router ACLs and routing table configurations use vendor-specific command syntax entirely different from the Snort rule format shown.

DAn Intrusion Detection SystemCorrect

The string 'alert tcp any any -> 192.168.100.0/24 21 (msg:"FTP on the network!";)' matches the exact Snort rule format consisting of an action keyword (alert), protocol (tcp), source and destination address-port pairs, and a parenthesized option block containing a human-readable message. Snort is a widely deployed open-source Intrusion Detection System that uses precisely this syntax to detect and alert on network activity matching defined patterns. No other device type listed uses this rule structure.

Concept tested: Snort IDS rule syntax identification

Source: https://docs.snort.org/rules/intro

Topics

#IDS rules#Snort#signature detection#alert syntax

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice