QuestionMay 3, 2026

Note: This contradictory behavior is related to the HIDS configuration. You are running Snort in passive mode.Recall from the initial examination of Snort's configuration that it is not configured in inline mode. In this configuration Snort cannot drop, sdrop or reject packets. It is possible to manipulate multiple networking interfaces on a system to emulate HIPS, but actually doing that is outside the scope of lab. The Snort FAQ will further tell you that Snorthos to be running in inline mode to drop packets. When running in passive mode, drop rules are not loaded, which Is why the first attempt ran the detection rule. Reject rules are loaded, but not effective which is why the reject rule, but the ping still worked. 27. Document this protection deficiency and suggest an alternative for Demand protecting the vulnerable WebServert?from insider attacks for Secure Labs on

Note: This contradictory behavior is related to the HIDS configuration. You are running Snort in passive mode.Recall from the initial examination of Snort's configuration that it is not configured in inline mode. In this configuration Snort cannot drop, sdrop or reject packets. It is possible to manipulate multiple networking interfaces on a system to emulate HIPS, but actually doing that is outside the scope of lab. The Snort FAQ will further tell you that Snorthos to be running in inline mode to drop packets. When running in passive mode, drop rules are not loaded, which Is why the first attempt ran the detection rule. Reject rules are loaded, but not effective which is why the reject rule, but the ping still worked. 27. Document this protection deficiency and suggest an alternative for Demand protecting the vulnerable WebServert?from insider attacks for Secure Labs on
Note: This contradictory behavior is related to the HIDS configuration. You are running
Snort in passive mode.Recall from the initial examination of Snort's configuration that it is
not configured in inline mode. In this configuration Snort cannot drop, sdrop or reject
packets. It is possible to manipulate multiple networking interfaces on a system to
emulate HIPS, but actually doing that is outside the scope of lab. The Snort FAQ will further
tell you that Snorthos to be running in inline mode to drop packets. When running in
passive mode, drop rules are not loaded, which Is why the first attempt ran the detection
rule. Reject rules are loaded, but not effective which is why the
reject rule, but the ping still worked.
27. Document this protection deficiency and suggest an alternative for
Demand protecting the vulnerable WebServert?from insider attacks for Secure Labs on

Solution
4.7(294 votes)

Answer

Implement a HIPS or configure Snort in inline mode for active protection. Explanation 1. Identify the Protection Deficiency Snort is running in passive mode, which means it cannot drop, sdrop, or reject packets. This limits its ability to actively prevent attacks, as it can only detect and alert. 2. Suggest an Alternative Solution Implement a Host-based Intrusion Prevention System (HIPS) that can actively block or reject malicious traffic. Alternatively, configure Snort in inline mode to enable packet dropping capabilities.

Explanation

1. Identify the Protection Deficiency<br /> Snort is running in passive mode, which means it cannot drop, sdrop, or reject packets. This limits its ability to actively prevent attacks, as it can only detect and alert.<br /><br />2. Suggest an Alternative Solution<br /> Implement a Host-based Intrusion Prevention System (HIPS) that can actively block or reject malicious traffic. Alternatively, configure Snort in inline mode to enable packet dropping capabilities.
Click to rate:

Similar Questions