312-50V9 · Question #64
When an alert rule is matched in a network-based IDS like snort, the IDS does which of the following?
The correct answer is B. Continues to evaluate the packet until all rules are checked. In Snort's default IDS mode, matching an alert rule does not stop rule evaluation - the engine continues checking the packet against all remaining rules.
Question
When an alert rule is matched in a network-based IDS like snort, the IDS does which of the following?
Options
- ADrops the packet and moves on to the next one
- BContinues to evaluate the packet until all rules are checked
- CStops checking rules, sends an alert, and lets the packet continue
- DBlocks the connection with the source IP address in the packet
How the community answered
(26 responses)- B88% (23)
- C4% (1)
- D8% (2)
Why each option
In Snort's default IDS mode, matching an alert rule does not stop rule evaluation - the engine continues checking the packet against all remaining rules.
Dropping packets is an IPS (Intrusion Prevention System) inline action and is not the default behavior of a network-based IDS like Snort operating in passive detection mode.
Snort processes packets through its rule sets sequentially and by default continues evaluating all applicable rules even after a match triggers an alert. This ensures that a single packet can generate multiple alerts if it matches multiple rules, providing comprehensive detection coverage without interfering with packet flow.
Stopping rule evaluation after the first match describes a 'first match' firewall behavior, not Snort's default rule processing model which evaluates all rules.
Blocking connections by source IP is a prevention action that requires Snort to be configured in inline IPS mode, not standard IDS monitoring mode.
Concept tested: Snort IDS rule evaluation and alert behavior
Source: https://docs.snort.org/start/rules
Topics
Community Discussion
No community discussion yet for this question.