Study tips 500-280

How is the basic construct of a port variable formatted in the Snort.conf file?

Which action should you perform to enable or disable entire classes of rules through the snort.conf file?

Which statement about the detection engine configuration settings in snort.conf is true?

What is the minimum action that you should take when configuring a new Snort installation?

Which syntax correctly expresses a port variable?

Which statement about the FTPTelnet preprocessor is true?

Which preprocessor can normalize the IIS %u encoding scheme?

which order are they placed into the preprocessors?

Which configuration is optimal for the frag3 engine?

Which preprocessor maintains connection state so that attacks that manifest over multiple packets in a session can be detected?