220-1102 · Question #641
A hotel's Wi-Fi was used to steal information on a corporate laptop. A technician notes the following security log: SRC: 192.168.1.1/secrets.zip Protocol SMB >> DST: 192.268.1.50/capture The…
The correct answer is D. 445. The security log indicates data theft occurred via SMB protocol, which typically uses port 445 for network file sharing, making it the most likely protocol involved in the incident.
Question
A hotel's Wi-Fi was used to steal information on a corporate laptop. A technician notes the following security log:
SRC: 192.168.1.1/secrets.zip Protocol SMB >> DST: 192.268.1.50/capture The technician analyses the following Windows firewall information:
Which of the following protocols most likely allowed the data theft to occur?
Exhibit
Options
- A1
- B53
- C110
- D445
How the community answered
(23 responses)- A4% (1)
- B9% (2)
- C4% (1)
- D83% (19)
Why each option
The security log indicates data theft occurred via SMB protocol, which typically uses port 445 for network file sharing, making it the most likely protocol involved in the incident.
Port 1 is often associated with TCPMUX, which is not relevant to SMB data transfer.
Port 53 is used for DNS (Domain Name System), which resolves domain names to IP addresses, not for file transfer.
Port 110 is used for POP3 (Post Office Protocol version 3), which is for receiving emails, not for SMB file sharing.
The security log explicitly states 'Protocol SMB' was used for the data transfer from 192.168.1.1 to 192.268.1.50. SMB (Server Message Block) is a network file sharing protocol that primarily operates over TCP port 445, making it the direct match for the reported data theft. The firewall information, if provided, would typically show whether port 445 was open or allowed for outbound connections.
Concept tested: Common network protocols and port numbers
Source: https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-overview
Topics
Community Discussion
No community discussion yet for this question.