CEH Footprinting, Reconnaissance and Scanning Practice Question

During a vulnerability scan with Nessus, you find that port 445/TCP is open on a Windows server. Which of the following is the MOST likely associated risk?

⚠ Common exam trap

The trap here is that candidates may associate port 445 with file sharing only and overlook its history of critical remote code execution vulnerabilities, instead choosing a more generic or unrelated attack vector like HTTP directory traversal.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Remote code execution via SMB vulnerabilities

Port 445/TCP is used by Microsoft SMB (Server Message Block) over a direct TCP connection, commonly known as SMB over TCP. SMB has historically been plagued by critical remote code execution vulnerabilities, most notably EternalBlue (MS17-010) exploited by WannaCry. Therefore, an open SMB port on a Windows server presents a high risk of remote code execution if unpatched.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
SNMP community string brute-forcing
Why it's wrong here
SNMP community string brute-forcing is an attack vector targeting Simple Network Management Protocol services, which primarily operate over UDP ports 161 (for agent requests) and 162 (for trap messages). If a Nessus scan identifies TCP port 445 as open, it indicates the presence of a different service, most commonly Server Message Block (SMB). Therefore, attempting to brute-force SNMP community strings against a service listening on port 445 would be entirely ineffective and misdirected.
✓
Remote code execution via SMB vulnerabilities
Why this is correct
Remote code execution (RCE) via SMB vulnerabilities is a highly relevant threat when TCP port 445 is found open, as this port is the standard for Server Message Block (SMB) communication. SMB implementations, particularly older versions or unpatched systems, have been historically plagued by critical RCE vulnerabilities, such as EternalBlue. A Nessus scan detecting an open port 445 would prompt an ethical hacker to investigate for specific SMB vulnerabilities that could allow an attacker to execute arbitrary code on the target system.
✗
HTTP directory traversal
Why it's wrong here
HTTP directory traversal vulnerabilities are specific to web servers, allowing an attacker to access files and directories outside the intended web root by manipulating URLs with sequences like "../". HTTP services typically run on TCP port 80 (for unencrypted traffic) or 443 (for HTTPS). If a vulnerability scan reports port 445 as open, it signifies a non-HTTP service, making HTTP-specific attacks like directory traversal irrelevant to the service identified on that particular port.
✗
DNS cache poisoning
Why it's wrong here
DNS cache poisoning is an attack aimed at corrupting the DNS resolver's cache with forged records, redirecting users to malicious IP addresses instead of legitimate ones. Domain Name System (DNS) services primarily communicate over UDP and TCP port 53. Since the vulnerability scan specifically identified TCP port 445 as open, which is associated with SMB, a DNS-specific attack like cache poisoning would not be applicable to the service running on that port, as it is not a DNS server.

Visual reference

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question