Exam PT1-002 topic 1 question 57 discussion

I would take A in this case. It has the ssh port (22) and at the same time, it runs the default scripts (-sC) to check for vulnerabilities. With B, only the version of SSH will be returned, and hence, you will have to go ahead to search for the corresponding CVEs.

C '--script vulners' is correct. While it does not reference Port 22, it is the only option that will conduct a scan against open ports for known vulnerabilities. While A and B reference Port 22, -sV is only scanning for versions of services running on the ports that are open. -sC is simply running a set of default scripts within NMAP against the target network. So nothing in A,B will scan for known vulnerabilities on the target.

The "-sV" option enables version detection, which helps identify the services and their corresponding versions running on open ports. The "-p22" option specifies that the scan should be performed specifically on port 22, which is the default port for SSH (Secure Shell) services. By combining these options, the tester can obtain version information about the SSH service running on port 22. This can help identify any known CVEs associated with that particular version of SSH. The CVEs may include vulnerabilities that can be exploited to gain unauthorized execution on the target Linux server.

The answer is C. If you run the command you will clearly see an enumeation of CVE listings. Guys and gals, please test these out for yourself.

C makes sense to me https://nmap.org/nsedoc/scripts/vulners.html

I would lean towards B on this one, the -sC option for default scripts does not seem to run NSE scripts that will actually find the CVE vulnerabilities (https://nmap.org/book/nse-usage.html#nse-category-default) in my research. In my testing the best command here would look something like, nmap -sV -p22 --script=vulners <target>, so my second best option would be to run a scan targeting port 22 and the version name/number, and cross reference that with exploit.db or other database. In the end, this is another one of "those" comptia questions that belong in the trash.

Read the following article that includes information on how to accomplish this: https://securitytrails.com/blog/nmap-vulnerability-scan In the above article, all scans include the -sV switch to identify service versions. All the the answers are missing the correct script scan database, as -sC means default scripts. The following command would do what they're looking for:| nmap -sV -p22 --script=vulscan/vulscan.nse www.example.com

-sC equivalent to default scripts

A makes more sense

Correct answer is D. -A scans for OS, version, and uses the default scripts (same as -sC). We don't know for a fact that SSHD service is running on port 22 so we'll do a normal scan.

answer is B

Yes, the Answer is : B

Correct Ans.: B