Network Scanning and Reconnaissance WAHS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company's security team wants to reduce the risk of internal network scanning by limiting the information available to potential attackers. They have a web server that only needs to respond to HTTP and HTTPS traffic from the internet. Which configuration is most effective for this goal?

   • AConfigure the firewall to allow only ports 80 and 443 from the internet and block all other inbound ports
   • BEnable ICMP echo responses on the firewall
   • CDisable the web server's error pages
   • DImplement MAC address filtering on the switch
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is it important to determine the version of a service running on an open port during a security assessment?

   • ATo determine the IP address of the target host.
   • BTo encrypt the communication with the service.
   • CTo bypass authentication on the service.
   • DTo identify known vulnerabilities associated with that specific version.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A penetration tester is scanning a target that is protected by an intrusion prevention system (IPS) which drops packets that match known scan signatures. The tester needs to identify open TCP ports and the services running on them, but must avoid detection. The tester has a limited time window. Which approach is most likely to succeed?

   • APerform a fast full-port TCP connect scan
   • BPerform a slow SYN scan with service version detection on a small set of common ports
   • CUse OS fingerprinting with the -O flag
   • DUse a UDP scan on all ports
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester is scanning a target network that has an IDS that triggers on port scans from a single IP address. The tester wants to perform a SYN scan while making it harder for the IDS to attribute the scan to the tester's IP. Which Nmap technique is most appropriate?

   • AUse the -T5 timing template
   • BUse the -sT connect scan
   • CUse the -O option
   • DUse decoy scans (-D)
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A penetration tester is conducting a red-team exercise against a target network that uses an IDS to detect port scans. The tester needs to scan all TCP ports on a target host, but the IDS is configured to alert on any scan that hits more than 100 ports in a 10-minute window from a single source IP. Which technique is most effective to avoid detection?

   • AUse Nmap's --scan-delay option to slow the scan and spread it over a longer period
   • BUse the -T5 timing template to complete the scan quickly
   • CUse the -O option to gather OS information instead
   • DUse the -sT connect scan to appear as normal traffic
   Reveal Solution Discussion Select an answer first