Exam CS0-002 topic 1 question 175 discussion

The question asks how to avoid directory traversal; a chroot jail is the best way to do this. Not that encrypting files can't help, but that answer feels more like it was put there for the people who remember the incident involved data loss. However, the question is about stopping the directory traversal. All of the solutions are good measure for FTP vulnerabilities, but chroot jail will do the most for the immediate act of traversal (the rest help mitigate things at other stages)

This would limit the FTP server’s access to a specific directory tree and prevent directory traversal attacks that could access files outside of that tree. Implementing file-level encryption, supporting FTPS, or upgrading the FTP server would not prevent directory traversal attacks.

C. Running the FTP server in a chroot jail will prevent attackers from accessing sensitive files located outside the FTP server's root directory (/opt/ftp/data). By default, FTP servers have access to the entire file system, but running it in a chroot environment will restrict its access to a specific directory.

chroot jail is correct

A is right

To reduce the risk of current and future directory traversal attacks targeted at the FTP server, a server administrator should reconfigure the FTP server to support FTPS (B). Directory traversal attacks, also known as path traversal attacks, involve manipulating file paths in order to access files or directories that are outside the intended scope of access. One way to reduce the risk of such attacks is to use a secure FTP protocol, such as FTPS (FTP over SSL/TLS). FTPS encrypts the communication between the FTP client and server, making it more difficult for attackers to intercept or manipulate data. Other measures that may be helpful in reducing the risk of directory traversal attacks include file-level encryption of sensitive files (A), running the FTP server in a chroot environment (C), and upgrading the FTP server to the latest version (D). However, implementing FTPS is likely to be the most effective measure in this case, as it addresses the specific vulnerability that was exploited in the directory traversal attack.

File encryption doesn't stop directory traversal. It is C.

C makes the most sense here.

Answer: C - Place local users in a chroot jail based on their home directory.

How is this not chroot jail?