GIAC Foundational Cybersecurity Technologies Practice Test

An alert indicates that a compromised host was used by an attacker to run the command below. What was the attacker attempting to do?

1. Map a network drive to a remote host

2. Identify services running on network hosts

3. Execute a script on a remote host

4. Send spoofed packets to network hosts

The correct answer is: Identify services running on network hosts

The command in question is commonly associated with querying information about services that are running on multiple hosts within a network. When an attacker uses a command with the purpose of identifying services, they are typically attempting to gather information that could be exploited later, such as determining which services are available, their versions, and potential vulnerabilities that could be targeted. By identifying running services, the attacker can find entry points or weaknesses in the network configuration or software. This reconnaissance step is crucial for planning their next moves in an attack, such as targeting specific vulnerabilities or misconfigurations. Although the other options may involve network interaction, mapping a network drive or executing scripts remotely would not align as closely with the primary intent of service enumeration. Sending spoofed packets involves a different method of attack targeting network communication, which does not relate to identifying services. Therefore, focusing on service identification provides the most relevant explanation of the attacker's intent in this scenario.