EC-Council
EC0-350 · Question #743
Which of the following snort rules look for FTP root login attempts?
The correct answer is D. alert tcp any any -> any any 21 (content:"user root";). See the full explanation below for the reasoning.
Question
Which of the following snort rules look for FTP root login attempts?
Options
- Aalert tcp -> any port 21 (msg:"user root";)
- Balert tcp -> any port 21 (message:"user root";)
- Calert ftp -> ftp (content:"user password root";)
- Dalert tcp any any -> any any 21 (content:"user root";)
How the community answered
(22 responses)- A5% (1)
- B5% (1)
- C14% (3)
- D77% (17)
Community Discussion
No community discussion yet for this question.