Certified Ethical Hacker (CEH v10) — Question 200

A penetration tester is conducting a port scan on a specific host. The tester found several ports opened that were confusing in concluding the Operating System
(OS) version installed. Considering that NMAP result below, which of the following is likely to be installed on the target machine by the OS? Starting NMAP 5.21 at
2011-03-15 11:06 NMAP scan report for 172.16.40.65 Host is up (1.00s latency). Not shown: 993 closed ports PORT STATE SERVICE 21/tcp open ftp 23/tcp open telnet 80/tcp open http 139/tcp open netbios-ssn 515/tcp open 631/tcp open ipp 9100/tcp open MAC Address: 00:00:48:0D:EE:8

Answer options

• A. The host is likely a Linux machine.
• B. The host is likely a printer.
• C. The host is likely a router.
• D. The host is likely a Windows machine.

Correct answer: B

Explanation

The correct answer is B, as the presence of ports commonly associated with printers, such as port 515 for LPD and port 631 for IPP, suggests that the device is a printer. The other options are less likely because the specific combination of open ports points more towards printer functionality rather than a typical Linux, router, or Windows system.