CompTIA CySA+ Cybersecurity Analyst Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose E1

  E is correct because p4wnp1_aloa is the name of a well‑known offensive hacking toolkit commonly deployed on Raspberry Pi devices, making it an immediate indicator of a rogue or malicious implant on the network. Its open ports and Raspberry Pi MAC address reinforce that it does not belong in a corporate environment, so it must be investigated first.

• Chose E1

  I think you would not base your decision on just a nmap scan. You should obviously know your network: Why is there a ROKU or a Raspberry system in your network? I would wonder why a Roku device is there, but hey, maybe they have a gaming room? For a corporate environment I would though wonder why there is a Raspberry present. These types of computers get used more and more in appliances and could have a reason to be there, but with all those ports open??? That would be negligence of the supplier.

• 18

  The analyst should first look at E. p4wnp1_aloa.lan (192.168.86.56). This device is particularly suspicious because it is running services commonly associated with unauthorized or malicious activity, including: SSH (port 22): Often used for remote administration, it can be used for unauthorized remote access. rpcbind (port 111): Typically associated with Remote Procedure Call (RPC) services, which could be a vector for attacks. netbios-ssn (port 139) and microsoft-ds (port 445): Both ports are related to SMB, which is often exploited in network attacks. http-alt (port 8000): This could be a web service running on a non-standard port, potentially for malicious purposes. The MAC address indicates the device is from the Raspberry Pi Foundation, suggesting it might be a Raspberry Pi, which is sometimes used as a platform for penetration testing or unauthorized network activities (e.g., using the P4wnP1 tool, which is a popular pentesting tool for Raspberry Pi). This combination of factors makes it the most suspicious device in the list.