Online Access Free 500-280 Practice Test

How is the basic construct of a port variable formatted in the Snort.conf file?

• A.var arguments
• B.variable
• C.portvar value
• D.port variable

What does protocol normalization do?

• A.removes application layer data, whether or not it carries protocol-induced anomalies, so that packet headers can be inspected more accurately for signs of abuse
• B.compares evaluated packets to normal, daily network-traffic patterns
• C.removes any protocol-induced or protocol-allowable ambiguities
• D.compares a packet to related traffic from the same session, to determine whether the packet is out of sequence

Other than intrusion sensing, which other function set can Snort perform?

• A.packet logging and alerting
• B.packet sniffing and disassembly
• C.intrusion sensing and packet sniffing
• D.packet sniffing and logging

Which preprocessor uses a global directive and an engine instance directive in the snort.conf file for configuration to provide target context during packet reassembly?

• A.frag3
• B.frag2
• C.SMTP
• D.sfPortscan

Given the rule option byte_test:1, ,64,2;, what is the offset?

• A.cannot be determined
• B.1
• C.2
• D.64