Discuss GAQM CPEH-001 Exam Topic 2 Question 43

Which of the following snort rules look for FTP root login attempts?

Aalert tcp -> any port 21 (msg:'user root';)

Balert tcp -> any port 21 (message:'user root';)

Calert ftp -> ftp (content:'user password root';)

Dalert tcp any any -> any any 21 (content:'user root';)

Suggested Answer: D

The snort rule header is built by defining action (alert), protocol (tcp), from IP subnet port (any any), to IP subnet port (any any 21), Payload Detection Rule Options (content:''user root'';)

Get Premium CPEH-001 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

14 comments · newest first

Shawnna 12 months ago

Wait, are we really looking for 'user root'? That seems risky!

Ryan 12 months ago

D is way too broad, can't be right.

Ernie 1 year ago

C seems off, FTP doesn't use 'user password' like that.

Avery 1 year ago

I think B is the right one, not A.

Jamal 1 year ago

Definitely A, it looks correct.

Maryanne 1 year ago

I feel like option C might be the right choice since it specifically mentions 'user password root', but I can't recall if it needs to be formatted differently.

Nicolette 1 year ago

I’m a bit confused about the difference between 'msg' and 'message' in the rules. Does it affect how the alert is triggered?

Ellsworth 1 year ago

I remember practicing with similar questions, and I feel like the keyword 'content' is important for matching specific strings.

Emmett 1 year ago

I think option A looks familiar, but I'm not sure if the syntax is exactly right for detecting FTP logins.

Starr 1 year ago

I'm a bit confused here. Is it something to do with the commit-id or the NTP configuration? I'll have to review those concepts.

Amie 1 year ago

The address pool used for a vHBA template is WWPN, right? That makes the most sense to me based on what I know about virtual HBAs.

Adelina 1 year ago

The internal and external audit reports might give me a good sense of the key risks and challenges the organization is facing. That could help inform the audit plan.

Buck 1 year ago

The key is to focus on the equipment mentioned in the options. I'll go through each one and see which one best fits the description.

Brittni 1 year ago

I think the entry should include both sales revenue and sales tax, but I'm not sure how to separate them correctly.

GAQM CPEH-001 Exam - Topic 2 Question 43 Discussion