GCIA · Question #102
Which of the following are not functions of the SNORT application? Each correct answer represents a complete solution. Choose two.
The correct answer is B. Virus detection C. Hard disk drive scanning. SNORT is a network-based intrusion detection/prevention system focused on network traffic; it has no capability to scan hard disks or detect file-based viruses.
Question
Which of the following are not functions of the SNORT application? Each correct answer represents a complete solution. Choose two.
Options
- APacket logging
- BVirus detection
- CHard disk drive scanning
- DPacket sniffing
- EIntrusion detection
How the community answered
(40 responses)- A3% (1)
- B80% (32)
- D5% (2)
- E13% (5)
Why each option
SNORT is a network-based intrusion detection/prevention system focused on network traffic; it has no capability to scan hard disks or detect file-based viruses.
Packet logging is a core SNORT mode that records network packets to disk for later analysis.
Virus detection is a function of antivirus software that inspects file signatures and behaviors; SNORT analyzes network packets using rule-based signatures and does not perform file-level virus scanning.
Hard disk drive scanning involves reading the storage medium for errors or malicious files, which is outside SNORT's scope - SNORT operates entirely on live network traffic, not local storage.
Packet sniffing is one of SNORT's three primary operating modes, capturing raw packets from the network interface.
Intrusion detection is SNORT's primary purpose, matching packet streams against a rule set to generate alerts on suspicious activity.
Concept tested: SNORT IDS capabilities and scope
Source: https://www.snort.org/faq
Topics
Community Discussion
No community discussion yet for this question.