350-201 · Question #125
A SOC team is investigating a recent, targeted social engineering attack on multiple employees. Cross- correlated log analysis revealed that two hours before the attack, multiple assets received…
The correct answer is D. Configure affected devices to disable the Finger service. TCP port 79 belongs to the Finger protocol, which attackers use to enumerate users for social engineering reconnaissance, and must be disabled to eliminate this attack vector.
Question
A SOC team is investigating a recent, targeted social engineering attack on multiple employees. Cross- correlated log analysis revealed that two hours before the attack, multiple assets received requests on TCP port 79. Which action should be taken by the SOC team to mitigate this attack?
Options
- ADisable BIND forwarding from the DNS server to avoid reconnaissance.
- BDisable affected assets and isolate them for further investigation.
- CConfigure affected devices to disable NETRJS protocol.
- DConfigure affected devices to disable the Finger service.
How the community answered
(38 responses)- A3% (1)
- B13% (5)
- C5% (2)
- D79% (30)
Why each option
TCP port 79 belongs to the Finger protocol, which attackers use to enumerate users for social engineering reconnaissance, and must be disabled to eliminate this attack vector.
BIND forwarding is a DNS feature operating on port 53 and is unrelated to the reconnaissance activity observed on TCP port 79.
Disabling and isolating affected assets is a containment measure that does not address the Finger protocol as the source of information leakage and does not prevent future reconnaissance via port 79 on other systems.
NETRJS (Network Remote Job Service) uses TCP ports 71 through 74, not port 79, so disabling it has no effect on the observed pre-attack reconnaissance traffic.
The Finger protocol (RFC 742) runs on TCP port 79 and exposes sensitive user information such as usernames, login times, and contact details - exactly the data needed to craft a targeted social engineering attack. Disabling the Finger service directly eliminates the reconnaissance capability observed on port 79 two hours before the attack, addressing the root cause of the information leakage.
Concept tested: Finger protocol TCP port 79 reconnaissance mitigation
Source: https://www.rfc-editor.org/rfc/rfc742
Topics
Community Discussion
No community discussion yet for this question.