LX0-104 · Question #420
What is the purpose of snort inline?
The correct answer is B. To have iptables use snort rules to filter packets.. Snort inline (specifically Snort_inline) is designed to integrate with a firewall like iptables, enabling Snort rules to directly filter, block, or modify packets in real-time, functioning as an Intrusion Prevention System (IPS).
Question
Options
- ATo run the snort daemon without forking child processes.
- BTo have iptables use snort rules to filter packets.
- CTo have snort log suspicious activity only, without performing any actions
- DTo run the snort daemon as a nonroot user.
How the community answered
(42 responses)- A5% (2)
- B90% (38)
- C2% (1)
- D2% (1)
Why each option
Snort inline (specifically Snort_inline) is designed to integrate with a firewall like iptables, enabling Snort rules to directly filter, block, or modify packets in real-time, functioning as an Intrusion Prevention System (IPS).
The number of child processes is a deployment detail and not the core purpose of Snort inline, which is about active packet manipulation.
Snort_inline allows Snort to act as an Intrusion Prevention System (IPS) by integrating with the kernel's packet filtering capabilities (like iptables) to drop or modify malicious packets based on Snort's detection rules, rather than just passively alerting.
Logging suspicious activity only, without performing actions, describes Snort's typical Intrusion Detection System (IDS) mode, not its inline (IPS) functionality.
Running Snort as a non-root user is a security best practice for any Snort deployment, but it is not the specific purpose of the 'inline' mode, which refers to its active prevention capabilities.
Concept tested: Snort inline (IPS) functionality
Source: https://www.snort.org/documents/snort-users-manual
Topics
Community Discussion
No community discussion yet for this question.