nerdexam
CompTIA

LX0-104 · Question #211

Which of the following methods can be used to deactivate a rule in Snort? (Select TWO correct answers)

The correct answer is A. Place a # in front of the rule and restart snort. B. Write a pass rule in local.rules and restart snort with the o option.. Two effective ways to deactivate a Snort rule are to comment it out with '#' and restart Snort, or to implement a pass rule that matches and bypasses the traffic that the original alert rule would have triggered.

Security

Question

Which of the following methods can be used to deactivate a rule in Snort? (Select TWO correct answers)

Options

  • APlace a # in front of the rule and restart snort.
  • BWrite a pass rule in local.rules and restart snort with the o option.
  • CDelete the rule and snort will automatically reread its rules files within five minutes.
  • DAdd the rule to /etc/snort/rules.deactivated and it will take effect immediately.

How the community answered

(24 responses)
  • A
    92% (22)
  • C
    4% (1)
  • D
    4% (1)

Why each option

Two effective ways to deactivate a Snort rule are to comment it out with '#' and restart Snort, or to implement a `pass` rule that matches and bypasses the traffic that the original `alert` rule would have triggered.

APlace a # in front of the rule and restart snort.Correct

Placing a '#' at the beginning of a rule line in a Snort rules file effectively comments it out, causing Snort to ignore it. A restart of the Snort daemon is then required for this change to take effect.

BWrite a pass rule in local.rules and restart snort with the o option.Correct

Writing a `pass` rule for specific traffic causes Snort to stop processing further rules for those packets, effectively deactivating any subsequent `alert` rules that would have matched the same traffic. The `pass` rule must be ordered correctly to take precedence.

CDelete the rule and snort will automatically reread its rules files within five minutes.

Deleting a rule requires Snort to be explicitly reloaded or restarted for the changes to apply; Snort does not automatically reread its rules files within a fixed timeframe like five minutes.

DAdd the rule to /etc/snort/rules.deactivated and it will take effect immediately.

There is no standard Snort mechanism or directory named `/etc/snort/rules.deactivated` that automatically deactivates rules or takes effect immediately without a reload or restart.

Concept tested: Snort rule deactivation methods

Source: https://www.snort.org/documents

Topics

#Snort#IDS rules#rule management#security monitoring

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full LX0-104 Practice