Nmap SMB Port 445 Patch Prioritization on Windows Hosts
Short answer
A Host 10.203.10.11 exposes TCP 445 (SMB), so it should be prioritized for the critical Windows SMB patch.
Question
$sudo nmap -Pn 10.203.10.0/24
The analyst then receives the following output:
Which of the following hosts should the analyst prioritize for patching?
Key Takeaways
It tests mapping Nmap port 445/microsoft-ds to SMB exposure and avoiding the -Pn false-positive trap, where listed hosts are not necessarily vulnerable.
This question tests Nmap output interpretation for SMB exposure: the analyst should patch host 10.203.10.11 because it is the only listed host with TCP 445 open. The key is to prioritize the vulnerable service port, not just hosts that appear in the scan.
Common mistake: Choosing a host merely because -Pn lists it as up or because it has another open port; only the host with TCP 445 open has the SMB service the patch addresses.
Expert Analysis
Service-first reading of the scan
The governing principle is that patch priority follows exposed vulnerable service, not mere host reachability. In Nmap output, an open port is evidence that a service is listening; the service/port mapping identifies which systems need the Windows SMB patch. SMB is associated with TCP 445 (microsoft-ds) and, in older NetBIOS-based configurations, TCP 139. The scan command uses -Pn, which skips host discovery and treats every address in 10.203.10.0/24 as online. That flag is useful when ICMP is blocked, but it does not make a host vulnerable and it does not prove a port is open. The decisive evidence remains the per-host port table.
Applying it to the exhibit
The scan output shows 10.203.10.11 with TCP 445 open, while the other candidate addresses do not expose that SMB port in their results. Therefore option A is the host to prioritize. Options B, C and D may appear in the scan because -Pn forces scanning, but their listed ports do not establish SMB exposure. A supplied comment makes the same essential point: SMB is tied to port 445, and option A is the only choice that includes it. That reasoning aligns with documented service behavior rather than vote counting.
Why the alternatives fail
Prioritizing 10.203.10.12, 10.203.10.13 or 10.203.10.16 would confuse being scanned or responding with having the vulnerable service exposed. A host can be listed by -Pn and still have no SMB listener; conversely, a filtered SMB port might need follow-up but is not the same as an open one. The patch is also scoped to Windows systems with open SMB, so an exposed TCP 445 service is the strongest selector in this scenario.
Operational takeaway
Use the Nmap port table to select the patching target, verify with -sV or a targeted -p 139,445 scan if needed, and remediate the host showing open SMB before broad patching.
Official Reference
- https://nmap.org/book/man-port-scanning-techniques.html
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements
These links open the official vendor documentation in a new tab.
Exam Strategy
When a CySA+ item gives Nmap output, first identify the port or service tied to the vulnerability before looking at host counts or reachability. Treat -Pn as a scan-control flag, not proof that a host is vulnerable, and eliminate options whose output lacks the relevant port. For SMB questions, look for TCP 445 (and possibly 139) on a Windows-like profile, then select only the host that actually exposes that service.
Frequently Asked Questions
Why does 10.203.10.11 need patching first?
Does -Pn prove every host in 10.203.10.0/24 is vulnerable?
Should TCP 139 open also trigger SMB patching?
Community Votes
74% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
RoRoRoYourBoat 👍 1 Answered ASMB is tied to port 445, option A is the only one that includes port 445.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.