What is the purpose of rate limiting network connections as a scanning countermeasure?

To encrypt all incoming connections.

To slow down or block rapid connection attempts that are characteristic of automated scanning tools.

To hide the IP address of the server.

A penetration tester is scanning a target network that has an intrusion detection system (IDS) configured to alert on rapid port scans. The tester wants to reduce the chance of detection while still performing a SYN scan of all 65535 ports. Which Nmap technique is most effective for this purpose?

Use the -O option to avoid detection

Use the -sT connect scan instead

Use the -T5 timing template for a faster scan

Use the -T1 timing template to slow the scan

A penetration tester is scanning a target and finds an open port that responds to a TCP connection but does not respond to Nmap's default service probes. The tester needs to identify the service running on that port. Which approach is most likely to yield useful information?

Run a UDP scan on the same port

Perform a full TCP connect scan on the port

Use OS fingerprinting with the -O flag

Use Nmap's version detection with the --version-intensity 9 option

A security analyst is scanning a target and receives inconsistent OS fingerprinting results. The first scan suggests Linux, but a second scan suggests Windows. The target is a web server that is known to be behind a load balancer. What is the most likely cause of the inconsistent results?

The target is running both Linux and Windows on the same host

The analyst used different source ports for each scan

The load balancer is terminating TCP connections and responding to the probes, masking the backend OS

The target is running a virtual machine that changes its network stack

EC-CouncilWeb Application Hacking and Security

Domain 8Objective 3

Network Scanning and Reconnaissance WAHS Practice Questions (Page 8)

Part of the Authentication and Session Management domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~25–41 in this domain), expect 8–14 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 36–40

36foundation · easy
What is the purpose of rate limiting network connections as a scanning countermeasure?
Select an answer first
37application · medium
A penetration tester is scanning a target network that has an intrusion detection system (IDS) configured to alert on rapid port scans. The tester wants to reduce the chance of detection while still performing a SYN scan of all 65535 ports. Which Nmap technique is most effective for this purpose?
Select an answer first
38application · medium
A penetration tester is asked to map the live hosts in a 192.168.10.0/24 network segment that is known to drop ICMP echo requests at the firewall. The tester wants to quickly identify which hosts are up before performing a detailed port scan. Which Nmap command best achieves this?
Select an answer first
39expert · hard
A penetration tester is scanning a target and finds an open port that responds to a TCP connection but does not respond to Nmap's default service probes. The tester needs to identify the service running on that port. Which approach is most likely to yield useful information?
Select an answer first
40expert · hard
A security analyst is scanning a target and receives inconsistent OS fingerprinting results. The first scan suggests Linux, but a second scan suggests Windows. The target is a web server that is known to be behind a load balancer. What is the most likely cause of the inconsistent results?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.