312-50V11 · Question #747
You just set up a security system in your network. In what kind of system would you find the following string of characters used as a rule within its configuration? alert tcp any any ->192.168.100.0/2
The correct answer is D. An Intrusion Detection System. The rule string shown is written in Snort IDS syntax, which uses a structured format of action, protocol, addresses, ports, and options to alert on specific network traffic patterns.
Question
You just set up a security system in your network. In what kind of system would you find the following string of characters used as a rule within its configuration? alert tcp any any ->192.168.100.0/24 21 (msg:""FTP on the network!"";)
Options
- Aa firewall IPTable
- BFTP Server rule
- CA Router IPTable
- DAn Intrusion Detection System
How the community answered
(26 responses)- A4% (1)
- B4% (1)
- D92% (24)
Why each option
The rule string shown is written in Snort IDS syntax, which uses a structured format of action, protocol, addresses, ports, and options to alert on specific network traffic patterns.
Firewall iptables rules use a different syntax structured around chains and targets, such as '-A INPUT -p tcp --dport 21 -j DROP', and do not use the alert keyword or msg option.
FTP servers control access through user authentication and configuration files, not through alert-based rule strings in this format.
Router ACLs and routing table configurations use vendor-specific command syntax entirely different from the Snort rule format shown.
The string 'alert tcp any any -> 192.168.100.0/24 21 (msg:"FTP on the network!";)' matches the exact Snort rule format consisting of an action keyword (alert), protocol (tcp), source and destination address-port pairs, and a parenthesized option block containing a human-readable message. Snort is a widely deployed open-source Intrusion Detection System that uses precisely this syntax to detect and alert on network activity matching defined patterns. No other device type listed uses this rule structure.
Concept tested: Snort IDS rule syntax identification
Source: https://docs.snort.org/rules/intro
Topics
Community Discussion
No community discussion yet for this question.