Network Scanning and Reconnaissance WAHS Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security analyst is performing a port scan on a target server. The analyst wants to identify open TCP ports and also determine the services running on them. The analyst is concerned about being detected by the target's firewall, which logs completed TCP connections. Which Nmap command is most appropriate?

   • Anmap -sS -sV target
   • Bnmap -sU target
   • Cnmap -sT -sV target
   • Dnmap -O target
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security consultant is scanning a target host and needs to identify the operating system. The consultant notices that the target responds to TCP packets with specific TTL values and window sizes that differ from typical Linux responses. Which Nmap feature is designed to analyze these characteristics to determine the OS?

   • ATraceroute (--traceroute)
   • BService version detection (-sV)
   • COS fingerprinting (-O)
   • DPing sweep (-sn)
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which of the following is an effective countermeasure to detect unauthorized network scanning?

   • ADeploying an Intrusion Detection System (IDS) that monitors for scan patterns.
   • BEncrypting all network traffic with TLS.
   • CDisabling all network services on the host.
   • DUsing strong passwords for all user accounts.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security consultant is performing OS fingerprinting on a target host that is behind a firewall that drops all ICMP traffic and only allows TCP on port 443. The consultant has already confirmed that port 443 is open. Which Nmap command is most appropriate to determine the OS?

   • Anmap -O -p 443 target
   • Bnmap -sS -p 443 target
   • Cnmap -sn target
   • Dnmap -sV -p 443 target
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A network administrator is concerned about unauthorized scanning of the internal network. The administrator wants to implement a defensive measure that can detect both fast and slow port scans. Which approach is most effective?

   • ADeploy an IDS with rules that track connection attempts to multiple ports on the same host over a configurable time window
   • BConfigure the firewall to block all ICMP traffic
   • CDisable all unused ports on the firewall
   • DUse a stateless firewall that does not log connections
   Reveal Solution Discussion Select an answer first