A network administrator discovers that telnet was enabled on the company’s Human Resources (HR) payroll server and that someone outside the HR subnet has
been attempting to log into the server. The network administrator has disabled telnet on the payroll server. Which of the following is a method of tracking attempts
to log onto telnet without exposing important telnet data.
A.
Banner grabbing
B.
Active port monitors
C.
Honeypot
D.
Passive IPS
Explanation:
Active Ports is a tool that monitors all open TCP and UDP ports on a local computer. You can watch which process has opened which port, because the program
maps ports to its owning application. Active Ports 1.4 also displays a local and remote IP address for each connection and allows you to terminate the owning
process. In this way, this program can help you to detect and stop trojans and other malicious programs. When you run Active Ports 1.4, it scans all your open
ports, and displays the following information about them: Process Name, PID, Local IP, Local Port, Remote IP, Remote Port, State, Protocol and Path. If you want
to know more about certain process, you can click on it and press the “Query Names” button. You will then see the name of the server trying to reach your IP. If you
don´t trust that process, you can terminate it through this program, pressing the “Terminate Process” button. You can also export the list of processes to a .csv file,
in order to keep or give someone a detailed report about your port usage.
Shouldn’t Honeypot be an acceptable answer as well?
0
0
I don’t think so ikam.
0
0
The question explicitly says the admin disabled telnet. I take that to mean, “Port 23 no longer has an active listener”. Monitoring open ports will not help.
0
0
I would say that the correct answer is a honeypot.
0
0
to log onto telnet without exposing important telnet data.
You would want the telnet port closed while monitoring attempts
0
0