ITPEC FE Subject A October 2025 Question 32

Port scanning — identifies open ports and running services during the reconnaissance phase of an attack.

Port scanning is a preliminary investigation technique. The attacker sends probes to various ports on a target system to discover which services are listening and potentially vulnerable. This happens before any actual exploitation.

Why not others:
- (a) Post-processing is about covering tracks after the attack — port scanning happens before
- (c) Privilege escalation is after gaining initial access — scanning for accounts to escalate is a later stage
- (d) Unauthorized action (data exfiltration) is the final stage — port scanning precedes any access

Key rule: Port scanning = reconnaissance = preliminary investigation stage, always happens first.

AI-generated — may contain errors