Port Scanning Techniques CEH Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security consultant is performing an authorized assessment of a legacy system that does not respond to TCP SYN packets but does respond to other TCP packets. The consultant wants to identify open ports on this system. Which scan technique is most likely to yield useful results?

   • ASYN scan (-sS)
   • BTCP connect scan (-sT)
   • CFIN scan (-sF)
   • DACK scan (-sA)
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An ethical hacker is performing a port scan against a target that has an intrusion prevention system (IPS) that drops packets when it detects a port scan. The hacker wants to avoid detection by making the scan traffic appear fragmented. Which Nmap option should be used?

   • A-p-
   • B-sS
   • C-f
   • D-O
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is responsible for protecting a critical application server. They have noticed an increase in port scans from external IPs. The team wants to implement a defensive measure that will slow down or discourage port scanning without affecting legitimate users. Which measure is most effective?

   • AEnable SYN cookies on the server to prevent SYN flood attacks
   • BImplement a firewall rule that drops all inbound TCP traffic from unknown IPs
   • CUse a port knocking mechanism that requires a specific sequence of connection attempts before opening ports
   • DSet the server to respond with RST to all SYN packets
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A penetration tester is performing an authorized scan of a target that is protected by an IDS that alerts on any TCP packet with the FIN, PSH, and URG flags set (Xmas scan signature). The tester wants to identify open ports using a FIN-based scan, but the IDS also alerts on a high rate of packets from a single source. The tester needs to avoid both the Xmas signature and the rate-based alert. Which Nmap command should the tester use?

   • Anmap -sX --scan-delay 5s target
   • Bnmap -sF --scanflags FINPSH --scan-delay 5s target
   • Cnmap -sF -T5 target
   • Dnmap -sF -D 10.0.0.1 target
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which statement accurately describes a key difference between TCP and UDP that is relevant to port scanning?

   • ATCP is connection-oriented and uses a three-way handshake, while UDP is connectionless and does not guarantee delivery.
   • BUDP uses a three-way handshake to establish a connection before sending data.
   • CUDP is more reliable than TCP because it uses sequence numbers and acknowledgments.
   • DTCP is faster than UDP because it has lower overhead.
   Reveal Solution Discussion Select an answer first