Free Isaca CCOA Actual Exam Questions - Question 14 Discussion

Maybe D too, since RDP directly exposes control of a system, making it a prime target for brute-force attacks. Unlike DNS or FTP, it’s not just data exposure but full remote control that’s risky here.

Maybe A makes the most sense here since SMB isn’t really designed for exposure to the internet, unlike FTP or DNS. It’s a common target for ransomware and often overlooked in firewall configs.

Option B stands out because FTP on TCP 21 transmits credentials in plain text, which is a big security flaw. Without encryption, anyone intercepting traffic can grab usernames and passwords easily. That makes it a serious risk, especially if used to allow internet access. Unlike SMB or RDP, FTP doesn’t inherently have strong built-in authentication or session encryption, so it’s often an easy target for attackers to gain access. Even if RDP or SMB have vulnerabilities, FTP’s lack of encryption takes the risk up a notch when exposed to the internet.

A. SMB on TCP 445 is often overlooked but it’s a massive attack vector. Unlike RDP, SMB is commonly targeted by automated malware spreading across networks, and it can give attackers direct access to file shares and system resources. Since it’s designed for internal network use, exposing it to the internet without any safeguards is really risky. I’d say it actually edges out RDP in some cases, especially given how many exploits exist specifically for SMB.

A. SMB on TCP 445 is actually a huge red flag too. It’s notorious for being exploited by worms and ransomware, like WannaCry. Exposing SMB directly to the internet can lead to serious breaches because it often shares sensitive files and system info. While RDP (D) is risky, SMB attacks can spread faster and cause wider damage, so A definitely deserves concern.

Not B, because FTP, while risky, often requires credentials and can be monitored more easily; RDP (D) directly exposes a remote desktop, making it an easier target for attackers to gain full control.

D, but does the question specify if these services are encrypted or not?