Which of the following does proper basic configuration of snort as a network intrusion detection system require?

The Snort configuration file (snort.conf) is where administrators set HOME_NET, EXTERNAL_NET, preprocessor options, and rule include paths that collectively define which packets Snort captures and inspects. Without these configuration file directives, Snort cannot apply detection logic selectively, which is the core requirement distinguishing an NIDS from a raw packet capture tool.

Capturing every packet indiscriminately describes a promiscuous-mode sniffer, not a properly scoped NIDS, which must apply rules and network variable filters.

Restricting capture to a single segment is a physical deployment decision, not a configuration requirement - Snort can be deployed to monitor multiple segments depending on sensor placement.

/var/log/snort is the default output directory for Snort alerts and logs; it controls where output is written, not which packets are captured or inspected.