Cisco Exam 500-285 Topic 1 Question 72 Discussion

Actual exam question for Cisco's 500-285 exam

Question #: 72
Topic #: 1

Which option describes the two basic components of Sourcefire Snort rules?

Apreprocessor configurations to define what to do with packets before the detection engine sees them, and detection engine configurations to define exactly how alerting is to take place

Ba rule statement characterized by the message you configure to appear in the alert, and the rule body that contains all of the matching criteria such as source, destination, and protocol

Ca rule header to define source, destination, and protocol, and the output configuration to determine which form of output to produce if the rule triggers

Da rule body that contains packet-matching criteria or options to define where to look for content in a packet, and a rule header to define matching criteria based on where a packet originates, where it is going, and over which protocol

Show Suggested Answer

Suggested Answer: D

by Tyra at Sep 15, 2024, 04:38 PM

Limited Time Offer

25%

Off

Get Premium 500-285 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Cassi

2 months ago

Option B is close, but I feel like it's missing something. The message part is important, but the matching criteria is the real heart of the rule.

upvoted 0 times

Susana

8 days ago

Option B is important for the message, but the matching criteria in option D is crucial for the rule to be effective.

upvoted 0 times

...

Melodie

19 days ago

D) a rule body that contains packet-matching criteria or options to define where to look for content in a packet, and a rule header to define matching criteria based on where a packet originates, where it is going, and over which protocol

upvoted 0 times

...

German

1 months ago

B) a rule statement characterized by the message you configure to appear in the alert, and the rule body that contains all of the matching criteria such as source, destination, and protocol

upvoted 0 times

...

Tambra

1 months ago

A) preprocessor configurations to define what to do with packets before the detection engine sees them, and detection engine configurations to define exactly how alerting is to take place

upvoted 0 times

...

Glen

2 months ago

Haha, I bet the person who wrote option A has never actually used Snort. Preprocessor configs? What is this, amateur hour?

upvoted 0 times

Ling

24 days ago

C) a rule header to define source, destination, and protocol, and the output configuration to determine which form of output to produce if the rule triggers

upvoted 0 times

...

Brittani

1 months ago

B) a rule statement characterized by the message you configure to appear in the alert, and the rule body that contains all of the matching criteria such as source, destination, and protocol

upvoted 0 times

...

Helene

1 months ago

A) preprocessor configurations to define what to do with packets before the detection engine sees them, and detection engine configurations to define exactly how alerting is to take place

upvoted 0 times

...