Network Scanning and Host Discovery CEH Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security analyst is configuring defenses against network scanning. The company runs a public web server on port 443 and an SSH server on port 22 for administrators. They want to allow legitimate SSH access but make it difficult for external scanners to discover the SSH port. They also want to maintain visibility of scanning attempts. Which combination of countermeasures is most effective?

   • AMove SSH to a non-standard port and disable ICMP
   • BDisable ICMP responses and block all ports except 443 and 22
   • CUse port knocking for SSH and configure the IDS to alert on port scans
   • DUse a firewall rule to allow SSH only from specific IP addresses
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which port scanning technique sends a packet with the FIN, URG, and PSH flags set, and expects closed ports to respond with an RST packet?

   • AUDP scan
   • BSYN scan
   • CXMAS scan
   • DTCP connect scan
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which defensive mechanism is designed to detect and alert on suspicious network scanning activity?

   • AEncryption
   • BPort knocking
   • CFirewall
   • DIntrusion Detection System (IDS)
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A penetration tester is assessing a network that has a firewall configured to drop all inbound TCP packets with the SYN flag set. The tester needs to identify open TCP ports on a target server. Which approach is most likely to succeed?

   • APerform a TCP SYN scan (-sS) against the target
   • BPerform a UDP scan (-sU) against the target
   • CPerform a TCP FIN scan (-sF) against the target
   • DPerform a TCP connect scan (-sT) against the target
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is performing passive reconnaissance on a target organization. The analyst wants to determine the operating system of a public-facing web server without sending any packets directly to the target. Which approach is most appropriate?

   • APerform an XMAS scan against the server
   • BUse Nmap's -O option to identify the OS
   • CSend a series of TCP packets with different TTL values to the server
   • DAnalyze HTTP response headers and error pages from cached or public sources
   Reveal Solution Discussion Select an answer first