Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Eccouncil 312-50 Exam - Topic 7 Question 23 Discussion

Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24 111(content:"|00 01 86 a5|"; msG. "mountd access";)
D) An alert is generated when a TCP packet originating from any IP address is seen on the network and destined for any IP address on the 192.168.1.0 subnet on port 111
A) An alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and destined to any IP on port 111
B) An alert is generated when any packet other than a TCP packet is seen on the network and destined for the 192.168.1.0 subnet
C) An alert is generated when a TCP packet is originated from port 111 of any IP address to the 192.168.1.0 subnet

Eccouncil 312-50 Exam - Topic 7 Question 23 Discussion

Actual exam question for Eccouncil's 312-50 exam
Question #: 23
Topic #: 7
[All 312-50 Questions]

Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24 111

(content:"|00 01 86 a5|"; msG. "mountd access";)

Show Suggested Answer Hide Answer
Suggested Answer: D

by Jutta at May 08, 2022, 08:30 PM

Limited Time Offer

25%

Off

Get Premium 312-50 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Dorthy
10 months ago
Not sure about that, sounds too broad to me.
upvoted 0 times
...
Adelle
10 months ago
Yup, it's all about that mountd access.
upvoted 0 times
...
Omer
10 months ago
Wait, isn't it also from any IP? Seems off.
upvoted 0 times
...
Chaya
11 months ago
Totally agree, it's about traffic to that subnet!
upvoted 0 times
...
Mel
11 months ago
The rule triggers on TCP packets to the 192.168.1.0 subnet on port 111.
upvoted 0 times
...
Erick
11 months ago
I’m a bit confused about the port part. I thought port 111 was for RPC services, but I can't remember how that fits into the alert generation.
upvoted 0 times
...
Kayleigh
11 months ago
I feel like option A is close, but it mentions "from any IP on the subnet," which doesn't seem right. I think it should be about packets going to the subnet instead.
upvoted 0 times
...
Luisa
11 months ago
I remember practicing a similar question where we had to identify the source and destination IPs. This seems like it could be option D, but I need to double-check.
upvoted 0 times
...
Marg
11 months ago
I think the rule is about TCP packets going to the 192.168.1.0 subnet, but I'm not sure if it's any IP or just specific ones.
upvoted 0 times
...
Jeniffer
11 months ago
Okay, let me think this through. Expanding the replenishment lead time doesn't seem like it would improve the service level, and decreasing safety stock would do the opposite of what we want. Holding more cycle stock could work, but increasing safety stock is probably the best choice here.
upvoted 0 times
...
Lorrie
11 months ago
This seems pretty straightforward - the requirement is for a field where users can write detailed descriptions that can include pictures and links, so I'd go with the Rich Text Area option.
upvoted 0 times
...
Stephania
11 months ago
The key is to look at the source and destination IP addresses in the packets. The client's IP address is the one that is the source in the first packet, which is 192.168.246.11. That's my strategy for solving this type of question.
upvoted 0 times
...
Gearldine
11 months ago
I read about extensions as well, but I think those are more about adding onto existing features rather than creating new ones.
upvoted 0 times
...

Save Cancel