22. A Linux server is running a log collector that needs to be hardened. A network administrator executes netstat to find open ports on the server. Which of the following ports should be disabled?
Answer: C
Port 162 should be disabled.
Port 162 is commonly used for SNMP (Simple Network Management Protocol) traps, which can expose the server to unnecessary security risks if not required. Disabling this port can help prevent unauthorized access and potential exploitation.
A) 22
Port 22 is the default port for SSH (Secure Shell) connections, which are crucial for secure remote administration of Linux servers. Disabling this port would hinder necessary remote access for legitimate administrative purposes, making it incorrect to disable.
B) 80
Port 80 is used for HTTP traffic and is essential for serving web content. Disabling this port would disrupt any web services running on the server, making it impractical to disable unless the server is not hosting a web application.
C) 162
Port 162 is specifically used for receiving SNMP traps. If the log collector does not require SNMP functionality, this port should be disabled to enhance security by minimizing the attack surface of the server.
D) 514
Port 514 is typically used for syslog, which is vital for logging and monitoring activities on the server. Disabling this port would impair logging capabilities, making it an unsuitable choice to disable.
Conclusion
Port 162 should be disabled because it poses security risks if SNMP is not actively used. In contrast, ports 22, 80, and 514 provide essential services for secure remote access, web hosting, and logging, respectively. Therefore, disabling port 162 is the most effective action to enhance the server's security without compromising necessary functionalities.