Question 1

Which file is the primary configuration file for keeping rules up to date?

Accepted Answer

The primary configuration file for keeping rules up to date is "pulledpork.conf," which is used by the PulledPork script to manage and update Snort rules.

Question 2

Which action is valid for decoder/preprocessor stub rules?

Accepted Answer

The answer of Which action is valid for decoder/preprocessor stub...

Question 3

Which configuration is optimal for the frag3 engine?

Accepted Answer

Binding target IP addresses to policies that represent operating systems allows the IPS engine to process traffic in a manner consistent with how the target hosts would, optimizing detection and response.

Question 4

Which preprocessor maintains connection state so that attacks that manifest over multiple packets in a session can be detected?

Accepted Answer

Stream5 is a preprocessor in Snort that maintains connection state, allowing it to detect attacks that manifest over multiple packets in a session.

Question 5

Which management and analysis tool can you use to enhance a Snort installation?

Accepted Answer

PulledPork is a tool specifically designed to manage and update Snort rules, enhancing the Snort installation by ensuring it has the latest rules and configurations.

Question 6

A Snort sensor is generating many false-positive sfPortscan alerts, in which busy, trusted hosts are flagged as the source of port sweep events. Which tuning strategy can mitigate this problem?

Accepted Answer

Adding the host to the Ignore Scanner list will prevent Snort from flagging it as a source of port sweep events, thus reducing false positives.

Question 7

Given the rule option byte_test:1, ,64,2;, what is the offset?

Accepted Answer

The answer of Given the rule option byte_test:1, ,64,2;, what...

Question 8

What is a GID?

Accepted Answer

GID stands for Generator ID, which is often used in contexts such as identifying a specific generator in systems or software.

Question 9

Which preprocessor uses a global directive and an engine instance directive in the snort.conf file for configuration to provide target context during packet reassembly?

Accepted Answer

Frag3 is the preprocessor in Snort that uses a global directive and an engine instance directive in the snort.conf file for configuration to provide target context during packet reassembly.

Question 10

Which statement about the distribution of SO rules is true?

Accepted Answer

The answer of Which statement about the distribution of SO...

Question 11

Which character must a rule body end with?

Accepted Answer

The answer of Which character must a rule body end...

Question 12

Which preprocessor plays a role in detecting the reconnaissance phase of an attack?

Accepted Answer

sfPortscan is a preprocessor in Snort that is specifically designed to detect port scanning activities, which are often part of the reconnaissance phase of an attack.

Question 13

Which rule keyword categorizes alerts into attack classes?

Accepted Answer

The keyword "classtype" is used in rule definitions to categorize alerts into predefined attack classes.

Question 14

What is VRT?

Accepted Answer

VRT stands for Vulnerability Research Team, which is a group focused on identifying and researching vulnerabilities in software and systems.

Question 15

Which keyword can you use to try to close a session when an alert is triggered?

Accepted Answer

The answer of Which keyword can you use to try...

Question 16

Which information does the rule body contain?

Accepted Answer

The rule body contains the specification of which portion of a packet payload to examine.

Question 17

Which file defines Snort IDs and associated alert labels that are not provided within the unified output format?

Accepted Answer

The "sid-msg.map" file is used in Snort to map Snort IDs (SIDs) to alert messages, which are not included in the unified output format.

Question 18

What is the primary source for Snort rules?

Accepted Answer

The primary source for Snort rules is www.snort.org, where official rulesets and updates are provided by the Snort team.

Question 19

Which keyword can you use to check a packet IP header TTL value?

Accepted Answer

The ttl keyword can be used to check a packet IP header TTL value.

Question 20

Which preprocessor provides a means to measure Snort performance?

Accepted Answer

The "performance statistics" preprocessor in Snort is specifically designed to measure and report on the performance of Snort, providing insights into how well Snort is operating.

Exam 47: Designing Cisco Unified Contact Center Enterprise (UCCED)