200-201 Security Monitoring Practice Question
In Snort, a rule is written as: alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"SMB exploit attempt"; flow:to_server; content:"|ff|SMB"; nocase;). What does the 'flow:to_server' option indicate?
⚠ Common exam trap
Cisco often tests the distinction between 'to_server' and 'from_server' in the 'flow' keyword, where candidates mistakenly think 'to_server' applies to any traffic involving the server, rather than specifically traffic directed toward the server from the client.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply to traffic from client to server
In Snort, the 'flow:to_server' option directs the rule to match only traffic traveling from the client to the server, based on the direction specified in the rule header. Since the rule header defines the source as $EXTERNAL_NET and destination as $HOME_NET, 'to_server' evaluates traffic flowing from the external network (client) to the home network (server), which is the correct direction for detecting an inbound SMB exploit attempt.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply to bidirectional traffic
Why it's wrong here
Bidirectional is 'flow:established'.
- ✓
Apply to traffic from client to server
Why this is correct
'to_server' matches client-to-server direction.
- ✗
Apply only to traffic from server to client
Why it's wrong here
That would be 'flow:from_server'.
- ✗
Ignore the direction of traffic
Why it's wrong here
Snort does consider direction.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.