PEN-200 Enumeration and Reconnaissance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The NFS service is vulnerable to a buffer overflow that allows remote code execution.

  Why it's wrong here

  While NFS implementations may have vulnerabilities, the scenario describes a misconfiguration (export to everyone) rather than a specific software vulnerability. The primary risk here is unauthorized access due to weak export permissions, not a buffer overflow. Assuming a buffer overflow without evidence is speculative.

• ✗

  An attacker can use the NFS share to perform a denial-of-service attack by filling the disk.

  Why it's wrong here

  A denial-of-service by filling the disk is possible if the share is writable, but it is not the most significant risk. The ability to read and modify user files, including SSH keys and sensitive data, poses a much greater threat because it can lead to full system compromise. The question asks for the most significant risk.

• ✗

  The NFS share allows anonymous FTP access to the same directory.

  Why it's wrong here

  NFS and FTP are separate protocols. An NFS export does not imply that FTP is running or that it shares the same directory. This option incorrectly conflates two different services. The presence of NFS on port 2049 does not indicate anything about FTP.

• ✓

  An attacker can mount the share and read or modify any user's home directory files, potentially leading to privilege escalation.

  Why this is correct

  When NFS exports a directory to everyone (i.e., world-readable and writable), any remote attacker can mount it without authentication. This grants access to all files within /home, including sensitive data like SSH keys, configuration files, and scripts. If writable, an attacker could inject malicious code or modify authorized_keys to escalate privileges.