200-201 Security Monitoring Practice Question
A security analyst is reviewing Snort IDS alerts and sees the following rule triggered: alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:'Possible SQL Injection'; content:'UNION'; nocase; sid:1000001;). Which action will Snort take when it detects matching traffic?
⚠ Common exam trap
Cisco often tests the distinction between Snort's 'alert' action (IDS behavior: alert and log) versus 'drop' or 'reject' actions (IPS behavior: block or reset), and candidates mistakenly assume any triggered rule will block traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Generate an alert
The rule uses the Snort 'alert' action, which instructs Snort to generate an alert when the traffic matches the specified conditions (TCP traffic from any port on the home network to port 80 on an external network, with the string 'UNION' present in the payload, case-insensitive). Snort's default behavior for an 'alert' action is to log the packet and generate an alert, but it does not drop or reject the traffic because Snort is an IDS (Intrusion Detection System) by default, not an IPS (Intrusion Prevention System).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Generate an alert
Why this is correct
The 'alert' action generates an alert when the rule matches.
- ✗
Log the packet only
Why it's wrong here
'Alert' generates an alert and logs, not just log.
- ✗
Drop the packet
Why it's wrong here
'Drop' is used in IPS mode; this rule uses 'alert'.
- ✗
Reject the connection
Why it's wrong here
'Reject' sends a TCP RST; this rule uses 'alert'.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.