Question 470
For the following operational condition, which statement is accurate: An operator needs to identify which process owns an unexpected listening socket?
Explanation
Correct Answer
The decisive distinction is The socket table can show listening ports and owning processes when permitted. The targeted configuration is Use ss -ltnp with appropriate privileges to inspect socket-to-process mapping; a proper test shows The suspicious port is mapped to its actual process and approved service state.
Incorrect Answers
This option serves the scenario “A service uses TCP 636 and a firewall review labels it plain LDAP on port 389”. The decisive distinction is Different service variants can use separate well-known ports and security behavior. The present scenario is distinguished by “The socket table can show listening ports and owning processes when permitted”.
The option would apply to “An IPv6-only server uses ping for an IPv4 literal and mistakenly reports IPv6 routing is broken”. Here, IPv4 and IPv6 use distinct address families and routing tables. This question instead requires “The socket table can show listening ports and owning processes when permitted”.
The alternative can apply elsewhere, but The socket table can show listening ports and owning processes when permitted is the governing fact here; test by checking The suspicious port is mapped to its actual process and approved service state.