nerdexam
EC-Council

312-50V9 · Question #48

A pentester gains access to a Windows application server and needs to determine the settings of the built- in Windows firewall. Which command would be used?

The correct answer is A. Netsh firewall show config. The netsh command is the built-in Windows tool for viewing and configuring Windows Firewall settings from the command line.

Evading IDS, Firewalls, and Honeypots

Question

A pentester gains access to a Windows application server and needs to determine the settings of the built- in Windows firewall. Which command would be used?

Options

  • ANetsh firewall show config
  • BWMIC firewall show config
  • CNet firewall show config
  • DIpconfig firewall show config

How the community answered

(25 responses)
  • A
    88% (22)
  • B
    8% (2)
  • C
    4% (1)

Why each option

The netsh command is the built-in Windows tool for viewing and configuring Windows Firewall settings from the command line.

ANetsh firewall show configCorrect

Netsh (Network Shell) is the native Windows command-line utility for configuring and displaying network settings, including the built-in Windows Firewall. The subcommand 'netsh firewall show config' (legacy) or 'netsh advfirewall show allprofiles' displays current firewall rules and state on Windows systems.

BWMIC firewall show config

WMIC (Windows Management Instrumentation Command-line) does not expose a 'firewall' alias or subcommand for querying Windows Firewall configuration.

CNet firewall show config

The 'net' command manages network resources such as shares, users, and services, and has no 'firewall' subcommand.

DIpconfig firewall show config

Ipconfig is used exclusively to display and manage TCP/IP network interface configuration; it has no capability to query firewall settings.

Concept tested: Using netsh to query Windows Firewall configuration

Source: https://learn.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts

Topics

#Windows firewall#netsh command#firewall configuration#post-exploitation

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice