You have configured Snort, running on your Windows Server 2003, to connect to a MySQL
database.
You are now creating the Snort database in MySQL. At the MySQL prompt, what is the correct
command to create a database named: snortdb1?

You are going to configure your SuSe Linux computer to run Snort as your IDS. Prior to running
Snort, you wish to configure Apache and PHP, so you may use Snort monitoring tools in the
browser. You need to verify that Apache and PHP are running properly. What line needs to be
entered in the info.php file to test PHP on your Apache server?

You are configuring the new machine in your network that you wish to be used for Snort in your
network.
What is the switch used when telling Snort to apply the rules in the Snort Configuration file to
packets processed by snort?

You are configuring your new Intrusion Detection System, and studying the true-false matrix. You
read about the different types of alarms and events. Which of the following defines an event where
an alarm is indicating an intrusion when there is an actual intrusion?

You are configuring your Snort rules and you wish to tell Snort to log and send notice when a type
of packet is received, what rule action syntax will you use?

You have just installed a new IDS and are creating the analysis options. Since you wish for your
options to be based on time, which of the following will be able to meet your analysis needs?

You are reconfiguring your networks firewall to create a DMZ using three network interfaces. After
configuring the addresses on the interfaces, you are making the required changes in ISA Server
2006. You are going to use Network Template during this configuration change. What Network
Template is designed for this firewall topology?

You have decided to install Snort on your Windows Server 2003 and are making changes to the
default configuration file. You see the following two lines:
include classification.config
include reference.config
What should these two lines read, after you make your changes, on a default installation?

You are configuring the Snort Rules for your new IDS. You are creating the rules, and wish to
avoid the
Snort Rule IDs that are reserved for Snorts use. Which of the following is the range of Snort Rule

IDs that are reserved for Snorts use?

During your configuration of Snort, you wish to use priority levels in your rules. What are the three
options in the Snort rule that can be used to define the Priority level of the rule?