Which of the following snort rules looks for FTP login attempts?
A) Alert tcp any any - any any 21 (content:"user root"; msg:"FTP Login attempt";)
B) Alert ftp - any port 21 (content:"user login";)
C) -A INPUT -j LOG -dport 21 -p TCP
D) Tcp.port == 21 && host eq any

Question

Which of the following snort rules looks for FTP login attempts?
A) Alert tcp any any -> any any 21 (content:"user root"; msg:"FTP Login attempt";)
B) Alert ftp -> any port 21 (content:"user login";)
C) -A INPUT -j LOG -dport 21 -p TCP
D) Tcp.port == 21 && host eq any

Quizplus · Accepted Answer

The syntax of snort rules, ipchains acls, wireshark display filters, and tcpdump capture filters are all covered on the exam. You do not have to memorize the full languages, just become comfortable with what they look like.

Which of the Following Snort Rules Looks for FTP Login