PT0-002 · Question #216
A consultant just performed a SYN scan of all the open ports on a remote host and now needs to remotely identify the type of services that are running on the host. Which of the following is an…
The correct answer is C. Nmap. To identify the types of services running on open ports after a SYN scan, Nmap is the best active reconnaissance tool due to its robust service version detection capabilities.
Question
A consultant just performed a SYN scan of all the open ports on a remote host and now needs to remotely identify the type of services that are running on the host. Which of the following is an active reconnaissance tool that would be BEST to use to accomplish this task?
Options
- Atcpdump
- BSnort
- CNmap
- DNetstat
- EFuzzer
How the community answered
(20 responses)- B10% (2)
- C80% (16)
- D5% (1)
- E5% (1)
Why each option
To identify the types of services running on open ports after a SYN scan, Nmap is the best active reconnaissance tool due to its robust service version detection capabilities.
Tcpdump is a packet analyzer used for passive network monitoring and traffic capture, not for actively scanning remote hosts to identify running services.
Snort is an intrusion detection/prevention system (IDS/IPS) used for passive traffic analysis and threat detection, not for active service identification on remote hosts.
Nmap is an industry-standard active reconnaissance tool that can perform service version detection by sending various probes to identified open ports and analyzing the responses, accurately identifying the service and its version.
Netstat is a command-line tool used to display network connections and statistics on the local machine, not for performing remote active reconnaissance of services.
A fuzzer is used for vulnerability testing by sending malformed data to applications, not for the initial identification of service types running on open ports.
Concept tested: Service version detection with Nmap
Source: https://nmap.org/book/man-service-detection.html
Topics
Community Discussion
No community discussion yet for this question.