ITPEC FE Subject A October 2025 Question 32

At the preliminary investigation stage, to find services that can be attacked — port scanning is reconnaissance, done before any intrusion.

An attack runs roughly in this order: preliminary investigation, intrusion, privilege escalation, unauthorized action, post-processing (covering tracks). A port scan sends probes to many ports on the target and records which ones respond, revealing which services, and often which software versions, are running. The attacker then chooses a service with a known weakness to break in.

Answer (b)

Why not others:

• •(a) — post-processing erases evidence such as log entries after the attack; a port scan finds services and does not read logs.
• •(c) — privilege escalation happens after the attacker is already inside and looks for accounts or flaws inside the system, not for open ports from outside.
• •(d) — the unauthorized action stage steals or alters data after access is gained; a port scan reveals services, not user information.

Key rule: Port scanning is reconnaissance: it maps open ports and services before the break-in, which is why unused ports should be closed.

Security · AI-written, may contain errors