200-201 · Question #316
Refer to the exhibit. An attacker scanned the server using Nmap. What did the attacker obtain from this scan?
The correct answer is A. Identified a firewall device preventing the port state from being returned.. From the Nmap scan, the attacker identified the presence of a firewall device actively preventing the true state of ports from being returned, often indicated by a 'filtered' status.
Question
Refer to the exhibit. An attacker scanned the server using Nmap. What did the attacker obtain from this scan?
Exhibit
Options
- AIdentified a firewall device preventing the port state from being returned.
- BIdentified open SMB ports on the server.
- CGathered information on processes running on the server.
- DGathered a list of Active Directory users.
How the community answered
(26 responses)- A88% (23)
- C8% (2)
- D4% (1)
Why each option
From the Nmap scan, the attacker identified the presence of a firewall device actively preventing the true state of ports from being returned, often indicated by a 'filtered' status.
Nmap's 'filtered' state indicates that a firewall, router, or host-based filter is dropping probe packets, preventing Nmap from determining if a port is open or closed. This result directly informs an attacker that a network defense mechanism, such as a firewall, is in place.
A 'filtered' port state does not identify open ports; it indicates that a device is preventing the port's true state from being determined.
Nmap's standard port scan does not gather information on processes running on the server; that requires more advanced techniques like OS or service version detection, which are distinct from port state.
An Nmap port scan does not gather a list of Active Directory users; this would require authentication and directory-specific enumeration tools.
Concept tested: Nmap scan output interpretation (filtered ports)
Source: https://nmap.org/book/man-port-scanning-basics.html
Topics
Community Discussion
No community discussion yet for this question.