A system administrator is doing network reconnaissance of a company's external network to determine the vulnerability of various services that are running. Sending some sample traffic to the external host, the administrator obtains the following packet capture:

Based on the output, which of the following services should be further tested for vulnerabilities?

File integrity monitoring states the following files have been changed without a written request or approved change.
The following change has been made:
chmod 777 -Rv /usr
Which of the following may be occurring?

Hotspot Question
Welcome to the Enterprise Help Desk System. Please work the ticket escalated to you in the desk ticket queue.
INSTRUCTIONS
Click on me ticket to see the ticket details Additional content is available on tabs within the ticket First, select the appropriate issue from the drop-down menu. Then, select the MOST likely root cause from second drop-down menu If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

A security analyst received a compromised workstation. The workstation's hard drive may contain evidence of criminal activities.
Which of the following is the FIRST thing the analyst must do to ensure the integrity of the hard drive while performing the analysis?

A security administrator needs to create an IDS rule to alert on FTP login attempts by root. Which of the following rules is the BEST solution?