Snort started as a signature-based IDS (Intrusion Detection System). It has since evolved to incorporate behavior-based features. The document clarifies that Snort is not a behavior-based IPS (Intrusion Prevention System) or IDS, emphasizing its primary function as a signature-based IDS.

1. Snort started as what type of system?
A. Behavior-based IPS system
B. Signature-based IDS system
C. Behavior-based IDS system
D. Signature-based IPS system
Solution
B. Snort started as a signature-based IDS system. Today, Snort has grown to include behavior-
based features. A signature-based system examines data to check for malicious content. When
data is found that matches one of these known signatures, it can be flagged to initiate further
action. Answer A is incorrect because Snort is not a behavior-based IPS system. Answer C is
incorrect because Snort is not a behavior-based IDS system. Answer D is incorrect because
although Snort is signature based, it is considered an IDS system, not an IPS system. IPS systems
are unlike IDS systems in that IPS systems have much greater response capabilities and allow
administrators to initiate action upon being alerted