A Security administrator wants to configure policies that dictate what types of network traffic are allowed in the network. Which types of signature should he use to configure such type of policies?

DoS signatures are specifically tuned to detect denial-of-service attack patterns and anomalies, not to define general-purpose traffic permission and denial policies.

Connection signatures are designed to inspect and classify network traffic based on connection-level characteristics such as protocol, port usage, and session behavior, making them the appropriate mechanism for defining policies that dictate which types of network traffic are allowed or denied. They operate at the session and transport layer rather than matching specific exploit payloads, enabling broad traffic control policy enforcement across the network.

Exploit signatures detect specific known attack payloads and vulnerability exploitation attempts, not to broadly govern which categories of network traffic are permitted.

String signatures perform pattern matching against specific text or byte sequences in packet payloads for content-based threat detection, not for connection-level traffic policy control.