_______________________________________________ ________________________________________________

A security analyst, who is working for a company that utilizes Linux servers, receives the following results from a vulnerability scan: CVSS Base None CVE ID CVE-1999-0524 CVE-1999-0497 None CVE-2005-2150 5.0 Name ICMP timestamp request remote date disclosure Anonymous FTP enabled Unsupported web server detection Windows SMB service enumeration via isrvsvc 7.5 5.0 Which of the following is MOST likely a false positive? A. ICMP timestamp request remote date disclosure B. Windows SMB service enumeration via srvsvc C. Anonymous FTP enabled D. Unsupported web server detection An analyst is examining a system that is suspected of being involved in an intrusion. The analyst uses the command 'cat/etc/passwd and receives the following partial output: root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbinologin bin:x:2:2:bin:/bin:/usr/sbinologin sys:x: 3:3:sys:/dev:/usr/sbinologin sync:x:4:65534: sync:/bin:/bin/sync games :x:5:60: games :/usr/games :/usr/sbinologin man:x:6:12:man:/var/cache/man:/usr/sbinologin lp:x:7:7:1p:/var/spool/lpd:/usr/sbinologin mail:x: 8:8:mail:/var/mail:/usr/sbinologin news:x:9:9: news:/var/spoolews: /bin/bash Based on the above output, which of the following should the analyst investigate further? A. User daemon' should not have a home directory of /usr/sbin B. User 'root' should not have a home directory of /root c. User 'news' should not have a default shell of /bin/bash D. User 'mail' should not have a default shell of /usr/sbinologin