GSLC · Question #30
Which of the following is a signature-based intrusion detection system (IDS) ?
The correct answer is A. Snort. Snort is the classic open-source, signature-based network intrusion detection system (NIDS) that uses rule files to match known attack patterns in network traffic.
Question
Which of the following is a signature-based intrusion detection system (IDS) ?
Options
- ASnort
- BRealSecure
- CTripwire
- DStealthWatch
How the community answered
(45 responses)- A91% (41)
- B2% (1)
- C4% (2)
- D2% (1)
Why each option
Snort is the classic open-source, signature-based network intrusion detection system (NIDS) that uses rule files to match known attack patterns in network traffic.
Snort operates by comparing captured network packets against a database of predefined signatures (rules), making it a textbook signature-based IDS. It is widely recognized in security certifications and industry practice as the leading open-source signature-based NIDS, capable of real-time traffic analysis and packet logging.
RealSecure (IBM ISS) is a commercial IDS/IPS product but is primarily classified as a network-based anomaly and behavior detection system, not a pure signature-based tool.
Tripwire is a file integrity monitoring (FIM) tool that detects unauthorized changes to files, not a network signature-based IDS.
StealthWatch (Cisco) is a network behavior and anomaly detection platform that uses flow analysis, not signature matching.
Concept tested: Signature-based IDS identification and classification
Source: https://www.snort.org/documents
Topics
Community Discussion
No community discussion yet for this question.