312-50 Question 103
Select 2Unix/Linux, Telnet, FTP, TFTP, SMB, IPv6, and BGPDuring an authorized internal assessment of a Linux-based branch office network, you discover that several legacy management services are still enabled on dual-stack hosts and network devices. The client is concerned that remote attackers could capture credentials or make unauthorized configuration changes across the WAN. A review shows the following: administrators use Telnet to manage routers, a TFTP service is used to store router configuration backups, an anonymous FTP service distributes firmware images, SMB is exposed only to authenticated users on a file server, and the edge routers exchange routes with an ISP using BGP over IPv6. Which TWO findings represent the most immediate security weaknesses due to lack of built-in confidentiality or authentication in the protocol itself?
- A
Administrators use Telnet for router management
- B
The routers exchange BGP routes with the ISP over IPv6
- C
A TFTP service stores router configuration backups
- D
An authenticated SMB file share is available on the Linux file server
- E
An anonymous FTP service distributes firmware images
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are Telnet and TFTP. From a CEH perspective, these are classic legacy services that create exploitable conditions during internal assessments. Telnet provides no encryption, so credentials and commands can be captured directly from network traffic. TFTP, defined in RFC 1350, is a minimal file transfer protocol using UDP and does not include authentication or encryption, making it unsuitable for sensitive configuration storage. By contrast, SMB should be evaluated by version and hardening state rather than assumed insecure by definition, and BGP over IPv6 is not automatically insecure solely because it uses IPv6; its risk depends on routing-policy and session-protection controls. FTP is plaintext and anonymous access is risky, but the question asks for the most immediate weaknesses arising from lack of built-in confidentiality or authentication in the protocol itself. Best practice guidance aligns with replacing Telnet with SSH, avoiding TFTP for sensitive backups, restricting FTP use or replacing it with secure alternatives, hardening SMB, and protecting BGP sessions with filtering and authentication mechanisms where supported.
- A. Correct.
Correct. Telnet transmits session data, including usernames and passwords, in plaintext and provides no built-in encryption. On an internal network or across a WAN, this makes credential interception straightforward for an attacker with packet-capture capability or a position on the path. In practice, secure administration should use SSH instead of Telnet.
- B. Incorrect.
Incorrect. BGP does have well-known security concerns, and IPv6 does not inherently make it secure. However, the key issue in the scenario is 'lack of built-in confidentiality or authentication in the protocol itself' leading to immediate exposure like sniffable credentials or trivial unauthenticated changes. Standard BGP sessions typically rely on TCP and can be protected with mechanisms such as MD5/TCP-AO, GTSM, prefix filtering, and route-policy controls. The protocol is not typically used for interactive credential exchange in the way Telnet is.
- C. Correct.
Correct. TFTP is intentionally simple and does not provide authentication, encryption, or robust access controls. If router configuration backups are stored or retrieved via TFTP, an attacker who can reach the service may be able to read sensitive configuration files or potentially upload malicious ones, depending on server configuration. This is a classic weakness in legacy network management environments.
- D. Incorrect.
Incorrect. SMB has had significant historical vulnerabilities, but 'authenticated SMB' is not inherently insecure purely because of the protocol in the same way Telnet or TFTP are. Modern SMB versions support authentication, message signing, and in some cases encryption. The presence of an authenticated SMB share alone does not automatically indicate a lack of built-in confidentiality or authentication.
- E. Incorrect.
Incorrect. Anonymous FTP is a security concern because it can expose files to unauthorized users and classic FTP does not encrypt traffic. However, in this scenario the strongest protocol-level weakness tied specifically to unauthorized configuration handling and lack of built-in authentication is TFTP, while the clearest credential-exposure issue is Telnet. Anonymous FTP may be risky depending on what firmware is hosted, but it is not as immediately severe as Telnet credential disclosure or unauthenticated TFTP access to configurations.