Q: 20
[Information Gathering and Vulnerability Scanning] During a penetration test, the tester uses a vulnerability scanner to collect information about any possible vulnerabilities that could be used to compromise the network. The tester receives the results and then executes the following command:
snmpwalk -v 2c -c public 192.168.1.23
Which of the following is the tester trying to do based on the command they used?
Options
Discussion
D . Running snmpwalk right after a scan is classic for checking if a vulnerability is legit, especially with that public community string. It's not exploiting, just confirming the finding. Makes sense to me-anyone see it differently?
Option D not C. Using snmpwalk here is about checking the vulnerability flagged in the scan, not exploiting it.
Probably D, not C. snmpwalk isn't scripting an exploit here, it's just used to confirm if the scan result is a true positive or a false hit. Used a few times in practice tests myself.
C/D? I see why D fits but using snmpwalk feels kinda hands-on like scripting an exploit too.
I’d say D, saw similar question in a mock test. Using snmpwalk here is just to confirm if the scanner alert is legit.
Yeah, D here. Running snmpwalk after a scan is just to see if the default SNMP creds actually work, so it's about checking if the scanner alert is real. Pretty standard practice in pentests-correct me if I'm missing anything important.
Looks like C to me. Running snmpwalk feels like actively trying to exploit SNMP with default creds. I'd think that's scripting an exploit for access, not just validation. Maybe I'm missing something, but that's how I'd read it.
Its D, the command is validating if the scanner finding is real or a false alarm. Clear scenario.
Be respectful. No spam.
