Objective 1.1 Perform Reconnaissance on Target Systems and Networks. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is performing a port scan of a target host and receives the following Nmap output for a specific port: '22/tcp open ssh'. However, the analyst knows that the SSH service on this host is actually running on port 2222. What does this result indicate?

   • ANmap is reporting the service based on the port number, not actual service fingerprinting.
   • BThe port is closed, and Nmap is showing a false positive.
   • CThe port is open and the service is correctly identified as SSH.
   • DThe port is filtered by a firewall, and Nmap is showing a false positive.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A penetration tester needs to identify which hosts on a network are alive and which ports are open on those hosts. Which reconnaissance technique should be used?

   • AFingerprinting
   • BFootprinting
   • CEnumeration
   • DScanning
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which Nmap option is used to perform a port scan that identifies open ports on a target system?

   • A-sn
   • B-sS
   • C-sV
   • D-O
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A penetration tester needs to determine the exact version of the web server running on a target's port 80. Which Nmap command should be used?

   • Anmap -sn target
   • Bnmap -sS target
   • Cnmap -O target
   • Dnmap -sV target
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A penetration tester is conducting passive reconnaissance on a target organization. The tester has collected employee names and email addresses from LinkedIn and the company website. The tester now wants to discover the target's external IP address range without directly interacting with the target's systems. Which technique is most appropriate?

   • AUse Nmap to scan the target's domain name for open ports.
   • BUse WHOIS and DNS lookups to find IP ranges and domain registration details.
   • CUse social engineering to trick employees into revealing IP addresses.
   • DUse a web proxy to intercept traffic from the target's website.
   Reveal Solution Discussion Select an answer first