Exam 312-50 topic 4 question 1 discussion

The correct answer is C. Stops checking rules, sends an alert, and lets the packet continue. When an alert rule is matched in a network-based IDS like Snort, the IDS will: Stop checking rules: Once a rule is matched, Snort will stop evaluating the packet against the remaining rules. Send an alert: The IDS will generate an alert to notify the system administrator or security team about the potential threat. Let the packet continue: The packet will be allowed to continue through the network, as the IDS is only monitoring and alerting, not blocking traffic.