What is the purpose of a Snort rule in network security?

• A. To route packets based on IP addresses.
• B. To detect and prevent specific exploits or attacks.
• C. To log all network traffic without alerting.
• D. To encrypt traffic between hosts.

Answer: (B)

Snort rules are signature-based checks that identify malicious or suspicious traffic. They define patterns—such as specific payload content, protocols, or traffic behavior—and when traffic matches, Snort can raise an alert and, if configured as an intrusion prevention system, take action to block or drop the traffic. That’s why this option is correct: it captures the essence of what a Snort rule does—detecting exploits or attacks and optionally preventing them. The other ideas describe routing, silent logging, or encryption, which aren’t what Snort rules do; routing is handled by routers, encryption is about securing data in transit, and while Snort can log events, its primary purpose is detection (and possible prevention), not silent logging of all traffic.