Security Monitoring →hardMultiple ChoiceObjective-mapped

200-201 Security Monitoring Practice Question

An analyst is configuring a Snort rule to detect a known exploit targeting Apache web servers. The exploit sends a malicious HTTP POST request with a long User-Agent string. Which Snort rule header and options are most appropriate?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

alert tcp any any -> any 80 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

The rule 'alert tcp any any -> any 80' matches HTTP traffic, and 'content:"POST"' detects the method. The 'pcre' option can match the long User-Agent. The other options are incorrect because they don't specify port 80 or use wrong protocols.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
alert icmp any any -> any 80 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)
Why it's wrong here
ICMP does not have port numbers.
✗
alert tcp any any -> any 443 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)
Why it's wrong here
Port 443 is HTTPS, not HTTP.
✓
alert tcp any any -> any 80 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)
Why this is correct
This rule alerts on TCP to port 80, looks for POST and a long User-Agent.
✗
alert udp any any -> any 80 (content:"GET"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)
Why it's wrong here
HTTP uses TCP, not UDP, and the exploit uses POST.

Go deeper

200-201 Security Monitoring Practice Question

Why each option matters

Option-by-option breakdown

Related to this question