PT0-003 · Question #34
A penetration tester finishes an initial discovery scan for hosts on a /24 customer subnet. The customer states that the production network is composed of Windows servers but no container clusters. Th
The correct answer is A. Multiple honeypots were encountered. Seeing services like OpenSSH 1.2p2 open on 99 hosts, and port 161 (SNMP) with unknown banners on 110 hosts suggests a high level of uniformity, which is uncommon in real-world Windows environments. This strongly points to honeypots being present, possibly for detection or
Question
A penetration tester finishes an initial discovery scan for hosts on a /24 customer subnet. The customer states that the production network is composed of Windows servers but no container clusters. The following are the last several lines from the scan log:
Line 1: 112 hosts found... trying ports Line 2: FOUND 22 with OpenSSH 1.2p2 open on 99 hosts Line 3: FOUND 161 with UNKNOWN banner open on 110 hosts Line 4: TCP RST received on ports 21, 3389, 80 Line 5: Scan complete. Which of the following is the most likely reason for the results?
Options
- AMultiple honeypots were encountered
- BThe wrong subnet was scanned
- CWindows is using WSL
- DIPS is blocking the ports
How the community answered
(17 responses)- A76% (13)
- B6% (1)
- C6% (1)
- D12% (2)
Explanation
Seeing services like OpenSSH 1.2p2 open on 99 hosts, and port 161 (SNMP) with unknown banners on 110 hosts suggests a high level of uniformity, which is uncommon in real-world Windows environments. This strongly points to honeypots being present, possibly for detection or
Topics
Community Discussion
No community discussion yet for this question.