A Suricata IPS is deployed in inline mode. When a signature matches, what action keyword causes Suricata to drop the matching packet and generate an alert?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because in Suricata IPS mode, the drop action silently drops the matching packet and generates an alert in the alert log, blocking the attack without notifying the sender. A is wrong because alert only generates an alert log entry without dropping the packet, equivalent to IDS-only mode.
Full explanation below image
Full Explanation
B is correct because in Suricata IPS mode, the drop action silently drops the matching packet and generates an alert in the alert log, blocking the attack without notifying the sender. A is wrong because alert only generates an alert log entry without dropping the packet, equivalent to IDS-only mode. C is wrong because reject drops the packet but also sends an RST (for TCP) or ICMP port unreachable (for UDP) to the sender, actively notifying them that the packet was rejected. D is wrong because pass instructs Suricata to stop processing further rules for the packet and allow it, the opposite of blocking.