Question

While reviewing a PCAP file in Wireshark, an analyst follows a TCP stream on port 21 and observes the following exchange: '220 ProFTPD Server ready', 'USER backup_svc', '331 Password required', 'PASS Wint3r2024!', '230 User logged in'. Based on this capture, what is the most significant intrusion-analysis concern the analyst should document?',

Accepted Answer

The service account credentials were transmitted in clear text and are exposed to anyone capturing the traffic

Answer

The FTP server banner reveals a ProFTPD version that must be immediately patched

Answer

The 230 response code indicates the login attempt was rejected and access was denied

Answer

The traffic on port 21 confirms an active data exfiltration transfer is in progress