Study tips 500-280

Which preprocessor uses a global directive and an engine instance directive in the snort.conf file for configuration to provide target context during packet reassembly?

Which preprocessor provides a means to measure Snort performance?

Which preprocessor plays a role in detecting the reconnaissance phase of an attack?

Which tuning strategy can mitigate this problem?

What is the primary source for Snort rules?

Which statement about the distribution of SO rules is true?

Which management and analysis tool can you use to enhance a Snort installation?

Which file is the primary configuration file for keeping rules up to date?