Your team is moving from an older Firepower release that ran Snort 2 to a current Secure Firewall Threat Defense deployment running Snort 3, and the architects want to know what changes inside the inspection engine. Which statement best describes the Snort 3 architecture compared with Snort 2?
Select an answer to reveal the explanation.
Short Explanation
With Snort 3, you get modular inspectors managed through Lua configuration instead of Snort 2 preprocessors. Think of it as replacing separate tools with configurable modules while the detection engine remains in place.
Full Explanation
Snort 3 replaces Snort 2 preprocessors with modular inspectors, using Lua configuration to define how those inspectors operate. This is an architectural change in the organization and configuration of inspection components, not simply a faster detection matcher. The claim that Snort 3 retains preprocessors for protocol analysis, even with tighter integration into the detection engine, describes the legacy model rather than the inspector-based architecture. The claim that inspectors use conventional text policy files instead of Lua identifies the modular components correctly but gives the wrong configuration mechanism. The claim that the firewall manager, rather than Lua, manages inspector configuration confuses policy deployment and management with the engine’s configuration model. Exam caveat: product interfaces may present or generate policy differently from the underlying Snort configuration, so distinguish the management workflow from the inspection engine’s architecture. Practical check: inspect the Snort 3 configuration or generated engine settings and verify that inspector configuration is expressed through Lua rather than inferring the internal model from the management interface alone.