A network defender is analyzing a packet capture and sees a series of ICMP echo requests with increasing TTL values sent to a target host. The defender also sees TCP SYN packets sent to a range of ports on the same host. What is the most likely classification of this activity?

Reconnaissance attack using traceroute and port scanning.

Denial of service attack using ICMP flood.

Access attack using a man-in-the-middle technique.

Malware propagation using a worm.

Which activity is classified as active reconnaissance?

Sending ICMP echo requests to map live hosts

Reading job postings for technology stack details

Searching social media for employee names

Browsing the target's public website

EC-CouncilCertified Network Defender

Domain 1Objective 1

Network Attacks and Defense Strategies CND Practice Questions (Page 9)

Part of the Network Security Fundamentals and Defense Strategy domain, which makes up ~16% of our current practice bank.

53questions here

11free pages

12concepts

Questions 41–45

41application · medium
A network defender is analyzing a packet capture and sees a series of ICMP echo requests with increasing TTL values sent to a target host. The defender also sees TCP SYN packets sent to a range of ports on the same host. What is the most likely classification of this activity?
Select an answer first
42expert · medium
A network defender is analyzing a web application attack. The attacker submits a form that includes a malicious script in the 'username' field. When another user views the page, the script executes in their browser. Which type of attack is this?
Select an answer first
43foundation · easy
Which type of DoS attack involves sending a large number of connection requests to exhaust a server's connection table?
Select an answer first
44foundation · easy
Which activity is classified as active reconnaissance?
Select an answer first
45application · medium
A company wants to limit the impact of a compromised workstation on the rest of the network. They plan to place the workstation in a separate VLAN and restrict traffic between VLANs using a firewall. Which defense strategy does this represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.

Network Attacks and Defense Strategies CND Practice Questions (Page 9)

Questions 41–45

A network defender is analyzing a packet capture and sees a series of ICMP echo requests with increasing TTL values sent to a target host. The defender also sees TCP SYN packets sent to a range of ports on the same host. What is the most likely classification of this activity?

A network defender is analyzing a web application attack. The attacker submits a form that includes a malicious script in the 'username' field. When another user views the page, the script executes in their browser. Which type of attack is this?

Which type of DoS attack involves sending a large number of connection requests to exhaust a server's connection table?

Which activity is classified as active reconnaissance?

A company wants to limit the impact of a compromised workstation on the rest of the network. They plan to place the workstation in a separate VLAN and restrict traffic between VLANs using a firewall. Which defense strategy does this represent?

Keep studying — Network Security Fundamentals and Defense Strategy