Examkin

Question

Difficulty: Very hardCommon Ports and Protocols

A network security administrator is performing an audit of packet captures and perimeter firewall rules for an enterprise management enclave. Security policy dictates that all interactive remote command-line administration and directory service queries must use encrypted communications. The traffic inspection reveals two active services operating over default transport ports that transmit authentication credentials in cleartext. Which TWO of the following port and transport protocol combinations represent the unencrypted services that violate this security policy? (Select TWO.)

  1. TCP port 23, used for legacy Telnet terminal sessionsAnswer
  2. TCP port 389, used for standard Lightweight Directory Access Protocol (LDAP) queriesAnswer
  3. C
    TCP port 22, used for Secure Shell (SSH) remote management
  4. D
    UDP port 636, used for Lightweight Directory Access Protocol Secure (LDAPS)

Answer

TCP port 23 (Telnet) and TCP port 389 (LDAP) represent the unencrypted legacy services that transmit data in plain text.
Telnet operates on TCP port 23 and standard LDAP operates on TCP port 389 by default. Both transmit authentication headers and payload data in unencrypted cleartext across the network, failing the encryption policy requirement. Secure implementations require substituting Telnet with SSH (TCP port 22) and unencrypted LDAP with LDAPS (TCP port 636) or LDAP with StartTLS.

Step-by-Step Solution

1
Analyze the security policy requirements
Identify that services used for remote administration and directory services must be encrypted across the network.
Cleartext transmission of administrative sessions or directory lookups exposes credentials to packet sniffing.
2
Evaluate remote command-line administration protocols and default ports
Telnet runs on TCP port 23 and is unencrypted. SSH runs on TCP port 22 and is encrypted.
Telnet must be identified as a policy violation.
3
Evaluate directory service protocols, transport types, and default ports
Standard LDAP runs on TCP port 389 in unencrypted text. LDAPS runs on TCP port 636 over connection-oriented TCP, not UDP.
Standard LDAP on TCP port 389 must be identified as an unencrypted policy violation.

Key Concept

Identifying unencrypted network protocols and their standard TCP/UDP port assignments versus secure encrypted alternatives.
Rate this question

Topics

Common Ports and Protocols

More questions from this topic