CND (312-38) Network Defense Simulation
Network Scenario
Traffic & Logs
Question
Which of the following tools scans the network systems for well-known and often exploited vulnerabilities?
Expert Analysis
1. Network Activity: The logs show a source (Audit_Station) systematically probing common ports and fingerprinting services (Apache 2.4.41) to correlate them with known vulnerabilities. This is typical of a Vulnerability Assessment (VA) phase.
2. Identification: While modern defenders use tools like Nessus or OpenVAS, the question asks for the tool specifically known for scanning for "well-known and often exploited vulnerabilities" in a context often associated with the CND curriculum's historical foundation of automated scanners.
3. Why Correct (C): SATAN (Security Administrator Tool for Analyzing Networks) was one of the first widely released tools designed to automate the recognition of vulnerabilities over a network. It was the precursor to many modern scanning suites.
4. Why Others are Wrong:
- A & B: While Nessus and SAINT are powerful vulnerability scanners, in the context of specific exam-based historical definitions for "well-known vulnerabilities," SATAN is the foundational answer requested.
- D: HPing is a command-line oriented TCP/IP packet assembler/analyzer. It is used for testing firewalls and network performance, not for automated vulnerability database correlation.
5. Defensive Action: As a defender, if this activity is unscheduled, it must be treated as reconnaissance. Implement rate-limiting on the firewall to prevent aggressive scanning and ensure that internal "audit" stations are properly authenticated and logged.
- Port Scanning (e.g., Nmap): Simply identifies open doors (ports) and services.
- Vulnerability Scanning (e.g., SATAN/Nessus): Not only finds the doors but checks if the locks (services) have known flaws by comparing versions to a signature database.