Network Scanning and Reconnaissance WAHS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which port scanning technique completes the full TCP three-way handshake and is therefore more likely to be logged by the target system?

   • AFIN scan
   • BTCP Connect scan
   • CUDP scan
   • DSYN scan
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security engineer is performing a red-team exercise against a target network. The target uses an IDS that is known to flag scans that originate from a single IP and hit multiple ports on the same host. The engineer needs to scan all 65535 TCP ports on a critical server, but must avoid triggering the IDS. Which technique is most effective?

   • AUse Nmap with the -D option to spoof decoy IP addresses
   • BUse the -T5 timing template to finish the scan quickly
   • CUse the -sT connect scan to appear as normal traffic
   • DUse the -O option to gather OS information instead
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of a UDP port scan?

   • ATo identify open UDP ports and services that may be vulnerable.
   • BTo bypass firewall rules that only block TCP traffic.
   • CTo perform a stealthy scan that avoids detection.
   • DTo determine the operating system of the target host.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company wants to detect unauthorized network scanning of its web servers. The security team has a limited budget and needs a solution that can identify scan patterns without requiring new hardware. Which countermeasure is most appropriate?

   • ADeploy a commercial network intrusion prevention system (IPS)
   • BConfigure the existing firewall to log and alert on connection attempts to closed ports
   • CDisable ICMP echo responses on all servers
   • DImplement MAC address filtering on the network switch
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During a penetration test, an analyst discovers an open TCP port 8080 on a target server. The analyst needs to determine the exact service and version running on that port to search for known vulnerabilities, but wants to avoid sending a large number of probes that could trigger an alert. Which Nmap option combination is most appropriate?

   • Anmap -A -p 8080 target
   • Bnmap -O -p 8080 target
   • Cnmap -sS -p 8080 target
   • Dnmap -sV -p 8080 target
   Reveal Solution Discussion Select an answer first