Exam N10-008 topic 1 question 784 discussion

Actual exam question from CompTIA's N10-008

Question #: 784
Topic #: 1

A network technician has identified a breach and is attempting to determine how the attacker connected to a device on the network. The technician uses tcpdump to perform a port scan and receives the following result:

Which of the following describes how the attacker connected to the device?

A. The attacker used Telnet.
B. The attacker used VNC.
C. The attacker used SSH.
D. The attacker used RDP.

Show Suggested Answer

Suggested Answer: C 🗳️

by emilia_088 at March 3, 2024, 1:12 p.m.

Comments

Submit Cancel

Cavick

Highly Voted 1 year, 3 months ago

Selected Answer: C

Syn-ack signifies and SSH connection was successful on port 22.

upvoted 9 times

...

laosythai

Most Recent 7 months ago

Selected Answer: A

Did they mean to do “sun-ack” on port 23 and not 22 which would make more sense since 22 is secure shell and port 23 is Telnet and NOT secure meaning a breach is more likely…?

upvoted 2 times

...

Zach123654

1 year ago

Selected Answer: C

GPTTTT

upvoted 1 times

...

b0bby

1 year, 1 month ago

I don't know what to look for here. port 23 failed, port 22 syn-ack and port 3389 just syn. Don't know how to come to the conclusion any of these was the breach... I'm just assumming its RDP cause it tried twice??

upvoted 1 times

...

emilia_088

1 year, 3 months ago

A I go with Telnet

upvoted 2 times

[Removed]

1 year, 3 months ago

it is "ssh", he got a syn-ack from port 22 which means connection established

upvoted 7 times

...

8c5c521

1 year, 3 months ago

It's C. You could see that Port 23 was RST which means it was terminated and port 22 is Syn-ack which means it was established

upvoted 4 times

...