312-50 Question 69
Single answer▪ Port and Service DiscoveryDuring an authorized internal assessment, you need to identify which services are actually running on a Linux server at 10.10.20.15 without transferring files or logging in. A previous TCP SYN scan showed ports 22, 80, and 443 as open, but the customer wants to know whether those ports are really SSH and HTTP/HTTPS or if they are custom services bound to those ports. Which command is the most appropriate next step to accurately determine the services and versions running on those open ports while minimizing unnecessary traffic?
- A
nmap -sV -p 22,80,443 10.10.20.15
- B
nmap -O -p 22,80,443 10.10.20.15
- C
nmap -sn 10.10.20.15
- D
nmap -sU -p 22,80,443 10.10.20.15
Show answer and explanation
Correct answer: A
Explanation
For port and service discovery, once open TCP ports have already been identified, the most efficient next step is targeted service/version detection with Nmap using -sV against only those ports. This helps confirm whether the service matches the expected port assignment or whether a different application is listening there. In real assessments, services are frequently moved to nonstandard ports or proxied, so relying on port numbers alone is insufficient. Nmap's service detection behavior is documented in the Nmap Reference Guide and Network Scanning documentation, which explain that -sV sends probes and analyzes responses to identify the service and version. By restricting the scan to known open ports, the tester reduces noise and aligns with the principle of minimizing unnecessary traffic during authorized testing.
- A. Correct.
Correct. The -sV option enables service/version detection, which probes open ports to identify the actual application protocol and often the software version, even when a service is running on a nonstandard or misleading port. Limiting the scan to -p 22,80,443 minimizes unnecessary traffic by testing only the ports already known to be open. This directly addresses the scenario's goal of validating what services are really bound to those ports.
- B. Incorrect.
Incorrect. The -O option performs OS detection, not service detection. While OS fingerprinting can provide useful host-level information, it does not reliably tell you whether port 22 is SSH or whether port 80 is actually HTTP. A candidate might choose this because OS detection is also a form of fingerprinting, but it answers a different question.
- C. Incorrect.
Incorrect. The -sn option performs host discovery only and skips port scanning. It is useful for determining whether a host is up, but it provides no service or version information. Someone might pick this if they confuse basic host enumeration with service discovery.
- D. Incorrect.
Incorrect. The -sU option is used for UDP scanning. Ports 22, 80, and 443 are commonly TCP services, and the scenario specifically refers to previously identified open ports from a TCP SYN scan. Scanning these port numbers with UDP would not validate the TCP services bound to them and would create unnecessary, irrelevant traffic.