External port/exposure view. Scanned from node5 against each host's public address. Ports flagged with a severity are datastores, admin planes, or remote-access services that should not be internet-reachable; dangerous or non-allow-listed ports also raise Behavioral Alerts. Note the vantage point is node5 inside the cluster, so a deliberately allow-listed inter-node port can appear here — confirm true internet exposure from an off-cluster host.