200-201 Question 377
Single answerDuring a routine network audit, you discover an unknown process running on a server. You use the netstat command and identify that the process is listening on port 4444. What is the most appropriate action to take next?
- A
Investigate the process associated with the listening port to determine its legitimacy.
- B
Immediately block port 4444 on the server's firewall to prevent further connections.
- C
Reboot the server to terminate any potentially malicious processes.
- D
Ignore the listening port as it is likely part of a legitimate service.
Show answer and explanation
Correct answer: A
Explanation
When discovering an unknown process listening on a port, the first step is to investigate the process to verify its legitimacy. This can be done by identifying the service or application associated with the port and cross-referencing it with known services running on the system. Acting without investigation could lead to unnecessary disruptions or leave the system vulnerable to potential threats.
- A. Correct.
This is the correct approach. Investigating the process will help determine if it is legitimate or malicious before taking further action.
- B. Incorrect.
Blocking the port immediately could disrupt legitimate services if the process is not malicious. Investigation should occur first.
- C. Incorrect.
Rebooting the server may terminate the process temporarily, but it does not address the root cause or provide information about whether the process is legitimate or malicious.
- D. Incorrect.
Ignoring the listening port without investigation may expose the server to potential risks if the process is malicious.