nerdexam
CompTIA

LX0-104 · Question #297

While performing a security audit, an administrator discovers that a machine is accepting connections on TCP port 184, but it is not obvious which process has the port open. Which of the following…

The correct answer is E. lsof. The lsof command is used to list open files, and it can specifically show which process has a particular network port open, making it ideal for identifying the service bound to TCP port 184.

Security

Question

While performing a security audit, an administrator discovers that a machine is accepting connections on TCP port 184, but it is not obvious which process has the port open. Which of the following programs should the administrator use to find out?

Options

  • Atraceroute
  • Bstrace
  • Cdebug
  • Dnessus
  • Elsof

How the community answered

(70 responses)
  • A
    3% (2)
  • B
    9% (6)
  • C
    1% (1)
  • D
    6% (4)
  • E
    81% (57)

Why each option

The `lsof` command is used to list open files, and it can specifically show which process has a particular network port open, making it ideal for identifying the service bound to TCP port 184.

Atraceroute

`traceroute` diagnoses network paths and is irrelevant for identifying processes listening on local ports.

Bstrace

`strace` traces system calls and signals for a running process or command, but it's not designed to identify which process is listening on a specific port without knowing the process beforehand.

Cdebug

`debug` is too generic; there's no single standard `debug` command for this purpose.

Dnessus

`nessus` is a vulnerability scanner used for identifying security weaknesses, not for determining which local process is holding a specific port open.

ElsofCorrect

`lsof` (List Open Files) is a powerful utility that can list all open files and network connections along with the processes that own them. Using `lsof -i :184` would specifically show which process is listening on TCP port 184, identifying the responsible service.

Concept tested: Identifying processes using network ports

Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/monitoring_and_managing_system_status/listing-open-files-and-sockets_monitoring-and-managing-system-status#doc-wrapper

Topics

#security audit#open ports#process identification#lsof#network security

Community Discussion

No community discussion yet for this question.

Full LX0-104 Practice