GIAC Exam GCED Topic 9 Question 10 Discussion

Actual exam question for GIAC's GCED exam

Question #: 10
Topic #: 9

The security team wants to detect connections that can compromise credentials by sending them in plaintext across the wire. Which of the following rules should they enable on their IDS sensor?

Aalert tcp any 22 <> any 22 (msg:SSH connection; class type:misc-attack;sid: 122:rev:1;)

Balert tcp any any <> any 6000: (msg:X-Windows session; flow:from_server,established;nocase;classtype:misc-attack;sid:101;rev:1;)

Calert tcp any 23 <> any 23 (msg:Telnet shell; class type:misc-attack;sid:100; rev:1;)

Dalert udp any any <> any 5060 (msg:VOIP message; classtype:misc-attack;sid:113; rev:2;)

Show Suggested Answer

Suggested Answer: C

by Dick at May 04, 2022, 05:38 AM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!