A security team deploys Snort on a server with a single NIC that is connected to a SPAN port. The server also needs to be managed remotely via SSH. The team configures Snort to listen on the NIC and sets the alert output to a file. After starting Snort, the team notices that SSH connections to the server are extremely slow and often time out. What is the most likely cause and the best solution?

Snort is writing alerts to the same disk as the OS, causing I/O contention; move the alert file to a tmpfs.

Snort is dropping packets because the SPAN port is oversubscribed; use a dedicated monitoring interface.

Snort is consuming excessive CPU, starving the SSH daemon; reduce the rule set or offload processing.

The SPAN port is sending duplicate traffic back to the switch, causing a loop; disable STP on the port.

What is the purpose of the Network Vulnerability Test (NVT) feed in OpenVAS?

To manage user credentials for the web interface

To provide the vulnerability tests and associated metadata

To store scan results and reports

To configure network interfaces for scanning

A network administrator uses MRTG to monitor a WAN link. The administrator notices that the graphs show a consistent pattern of high utilization during business hours and low utilization at night. The administrator wants to detect anomalies in this pattern. Which approach is most effective?

Use MRTG's built-in anomaly detection feature to automatically identify deviations from the baseline.

Monitor the interface error counters in MRTG to detect physical layer issues.

Configure MRTG to generate alerts when utilization exceeds a fixed threshold (e.g., 90%).

Compare current utilization to historical averages for the same time of day and day of week.

LPIC-3 Security

Domain 4Objective 2

328.2 Network Intrusion Detection (weight: 4) LPIC-3-SECURITY Practice Questions (Page 4)

Part of the Topic 328: Network Security domain, which makes up ~27% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~9–16 in this domain), expect 2–4 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

8concepts

Questions 16–20

16expert · hard
A security team deploys Snort on a server with a single NIC that is connected to a SPAN port. The server also needs to be managed remotely via SSH. The team configures Snort to listen on the NIC and sets the alert output to a file. After starting Snort, the team notices that SSH connections to the server are extremely slow and often time out. What is the most likely cause and the best solution?
Select an answer first
17foundation · easy
Which Snort rule option is used to specify a message that will be included in the alert?
Select an answer first
18foundation · easy
Which command-line tool displays real-time bandwidth usage per network interface, with a text-based graph that updates dynamically?
Select an answer first
19foundation · easy
What is the purpose of the Network Vulnerability Test (NVT) feed in OpenVAS?
Select an answer first
20application · medium
A network administrator uses MRTG to monitor a WAN link. The administrator notices that the graphs show a consistent pattern of high utilization during business hours and low utilization at night. The administrator wants to detect anomalies in this pattern. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-SECURITY” is a trademark of its owner, used for identification only.

328.2 Network Intrusion Detection (weight: 4) LPIC-3-SECURITY Practice Questions (Page 4)

Questions 16–20

Which Snort rule option is used to specify a message that will be included in the alert?

Which command-line tool displays real-time bandwidth usage per network interface, with a text-based graph that updates dynamically?

What is the purpose of the Network Vulnerability Test (NVT) feed in OpenVAS?

A network administrator uses MRTG to monitor a WAN link. The administrator notices that the graphs show a consistent pattern of high utilization during business hours and low utilization at night. The administrator wants to detect anomalies in this pattern. Which approach is most effective?

Keep studying — Topic 328: Network Security