Snort is described as which of the following?

Snort is described as which of the following?

• A. Host-based IDS
• B. Signature-based antivirus
• C. Protocol Anomaly Detection
• D. Software-based, real-time network intrusion detection system

Answer: (D)

Snort is a software-based, real-time network intrusion detection system. It runs on a host and analyzes packets as they traverse the network, using a rule set to detect known attack patterns and suspicious activity in real time. This network-wide view distinguishes it from a host-based IDS, which monitors only a single device, and from antivirus software, which targets files on endpoints. While Snort can perform protocol analysis, its core function is live network traffic analysis with signature-based rules, making the description best aligned with a software-based, real-time network intrusion detection system.

Snort is a software-based, real-time network intrusion detection system. It runs on a host and analyzes packets as they traverse the network, using a rule set to detect known attack patterns and suspicious activity in real time. This network-wide view distinguishes it from a host-based IDS, which monitors only a single device, and from antivirus software, which targets files on endpoints. While Snort can perform protocol analysis, its core function is live network traffic analysis with signature-based rules, making the description best aligned with a software-based, real-time network intrusion detection system.