Network Scanning and Reconnaissance WAHS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A penetration tester needs to gather comprehensive information about a target web server, including open ports, running services, and the operating system, in a single scan. Which Nmap command is most appropriate?

   • Anmap -O target
   • Bnmap -sS target
   • Cnmap -A target
   • Dnmap -sV target
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A network administrator wants to detect unauthorized port scans on the corporate network. The administrator configures a firewall to log all dropped packets and sets up an IDS. Which additional measure is most effective in detecting stealthy SYN scans that use slow timing?

   • ADisable logging on the firewall to reduce noise
   • BConfigure the IDS to alert on multiple SYN packets to the same host from the same source over a long time window
   • CUse a stateless firewall that does not track connections
   • DOnly monitor outbound traffic
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In the context of web application security, what is the primary purpose of network scanning during the reconnaissance phase?

   • ATo identify live hosts, open ports, and running services that may be potential attack surfaces.
   • BTo bypass authentication mechanisms on the target web application.
   • CTo directly exploit known vulnerabilities in web applications.
   • DTo encrypt traffic between the attacker and the target server.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A penetration tester is conducting an authorized assessment of a critical production web server. The tester must identify open ports and service versions, but the server is protected by an IPS that automatically blocks source IPs that send more than 10 packets per second. The tester also needs to avoid disrupting the service. Which Nmap approach best balances stealth and completeness?

   • AUse -sS -O -T2
   • BUse -sT -sV -T2
   • CUse -sS -sV -T5
   • DUse -sS -sV -T2 --max-rate 5
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary goal of operating system fingerprinting?

   • ATo identify open ports on the target host.
   • BTo bypass the target's firewall.
   • CTo identify the operating system running on a target host.
   • DTo determine the physical location of the target host.
   Reveal Solution Discussion Select an answer first