CS0-004: CompTIA Cybersecurity Analyst (CySA+)Demo

By CompTIA · Question Mode

QuestionQ59

Vulnerability Management

An analyst runs Nmap scans to identify which hosts must be targeted for deployment of a critical Windows patch. The patch addresses a critical security flaw affecting open Server Message Block (SMB) ports, and this flaw applies to Windows systems only. The analyst scans using the following command:

$sudo nmap -Pn 10.203.10.0/24

The analyst receives the following output:

Question Image

Which of the following hosts should the analyst prioritize for patching?

  • A 10.203.10.11
  • B 10.203.10.12
  • C 10.203.10.13
  • D 10.203.10.16
Explanation

The critical flaw affects only Windows systems with an open SMB port (TCP 445). A TTL value of 128 in the Nmap output is characteristic of Windows hosts, while a TTL of 64 is characteristic of Linux/Unix-based hosts. Among the scanned hosts, 10.203.10.11 and 10.203.10.16 both show a TTL of 128, indicating they are Windows systems, while 10.203.10.12 and 10.203.10.13 show a TTL of 64, indicating non-Windows (Linux) systems and are therefore not vulnerable to this Windows-specific flaw. Of the two Windows hosts, only 10.203.10.11 has port 445/tcp reported as open; 10.203.10.16 does not have port 445 open at all. Since the vulnerability specifically requires an open SMB (445/tcp) port on a Windows host, 10.203.10.11 is the only host meeting both conditions and should be prioritized for patching.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!