A system administrator is investigating a security alert on a production server. A recent port scan identified that TCP port 9100 is unexpectedly open. Using the netstat command, the administrator links the open port to a process belonging to a print management application that was supposedly uninstalled last quarter. The corresponding service is still listed in the services console and is actively running. Which of the following is the MOST likely cause of this security vulnerability?
The correct answer is an orphaned service. An orphaned service is a service that remains on a system and continues to run even after the application it belongs to has been uninstalled. This creates a security vulnerability by leaving an unmanaged, and potentially unpatched, service listening on the network, as described in the scenario. A zombie process is a terminated process that remains in the process table and is not actively running or listening on a port. A misconfigured firewall rule could allow traffic to the open port, but the root cause of the port being open is the service itself. Improper privilege escalation is the act of a process or user gaining higher-level permissions, which is a different security issue than the one described.