A penetration tester is performing a validation scan after an organization remediated a vulnerability on port 443 The penetration tester observes the following output:

Which of the following has MOST likely occurred?

Question

A penetration tester is performing a validation scan after an organization remediated a vulnerability on port 443 The penetration tester observes the following output:

Which of the following has MOST likely occurred?

Accepted Answer

D. The organization moved services to port 8443 Port 8443 is a well-known alternate HTTPS port, and an open service on 8443 after remediation on 443 indicates the service was relocated rather than patched. A scanner would show 443 as closed or filtered and 8443 as open and serving the same application. This is a common but insufficient remediation approach that moves rather than fixes the vulnerability.

Answer

A. The scan results were a false positive. A false positive means the original scanner incorrectly flagged a non-existent vulnerability - it would not explain a change in port status observed in a follow-up validation scan.

Answer

B. The IPS is blocking traffic to port 443 An IPS blocking port 443 would present the port as filtered in scan output and would not cause port 8443 to appear open with an active service behind it.

Answer

C. A mismatched firewall rule is blocking 443. A mismatched firewall rule blocking 443 would show that port as filtered rather than closed and would not account for port 8443 suddenly being open and responsive.

A penetration tester is performing a validation scan after an organization remediated a vulnerability on port 443 The penetration tester observes the following output: Which of the following has…

Question

Exhibit

Options

How the community answered

Why each option

Topics

Community Discussion