Exam CAS-004 topic 1 question 268 discussion

Actual exam question from CompTIA's CAS-004

Question #: 268
Topic #: 1

Users are claiming that a web server is not accessible. A security engineer is unable to view the Internet Services logs for the site. The engineer connects to the server and runs netstat – an and receives the following output:

Which of the following is MOST likely happening to the server?

A. Port scanning
B. ARP spoofing
C. Buffer overflow
D. Denial of service

Show Suggested Answer

Suggested Answer: D 🗳️

by Amin4799 at April 1, 2023, 4:08 p.m.

Comments

Submit Cancel

Amin4799

Highly Voted 2 years, 1 month ago

Selected Answer: D

TCP connections in the TIME_WAIT state, which indicates that there are a lot of connections that are being closed. The large number of TIME_WAIT connections can be an indication that the server is experiencing a Denial of Service (DoS)

upvoted 8 times

...

last_resort

Highly Voted 2 years, 1 month ago

Selected Answer: D

DOS, due to contiguous ports listed and TIME_WAIT

upvoted 5 times

...

EAlonso

Most Recent 10 months ago

A. Port scan because the source port 0, but can't look for details...any help?

upvoted 1 times

...

d3bfb15

10 months, 1 week ago

Port scan. Of course, it is denying service, but that could happen as a consequence of an approved scan so not truly a DOS. Also, a port scan would be a very poor way to launch a DOS. There are more effective options I mean