A systems administrator performs a security audit on a newly deployed file server. A port scan reveals that TCP port 23 is in a LISTENING state. The server's documented purpose is to host SMB shares, and no other services were intentionally installed. The administrator is concerned this represents an unnecessary security risk due to the insecure nature of the protocol associated with this port. What is the MOST likely cause of this security vulnerability?
The correct answer is an active Telnet service. TCP port 23 is the well-known port for the Telnet protocol, which transmits data, including credentials, in cleartext and is considered a security risk. An active service is required to bind to a port and place it in a LISTENING state. A firewall rule may permit traffic to a port, but it does not cause the port to listen for connections; only an active service or application can do that. A zombie process is a terminated process whose entry remains in the process table but does not actively hold resources like a listening network socket. The hosts file is used for local hostname-to-IP address resolution and has no role in opening network ports.