Your organization has a /16 network with multiple subnets. You need to detect scanning activity, but you have limited resources and cannot deploy sensors on every subnet. Which strategy is most effective for detecting scans across the entire network?

Use a honeypot on one subnet to detect scans

Deploy a centralized NIDS that monitors traffic at the core switch

Place a NIDS on each subnet's broadcast domain

Enable logging on all endpoint firewalls and aggregate logs

You need to discover live hosts on a network where the firewall drops ICMP and all TCP SYN packets to closed ports. However, the firewall allows TCP connections to open ports. Which host discovery technique is most likely to succeed?

TCP SYN ping to common open ports (-PS 80,443)

During the initial stages of an incident response, you need to understand which systems on the network are reachable and what services they expose. What is the primary purpose of performing network scanning in this context?

To collect forensic evidence from compromised hosts

To immediately block all identified open ports

To determine the root cause of the incident

To identify live hosts and open ports to map the attack surface

After discovering an open port on a critical server, you need to identify the exact service and version running on that port to assess potential vulnerabilities. You have network access to the port but you want to minimize the risk of crashing the service. Which Nmap command is most appropriate?

nmap -sV --version-intensity 9 -p

GIAC Certified Incident Handler

Domain 5Objective 1

Scanning and Mapping GCIH Practice Questions (Page 1)

Part of the Network and Infrastructure Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 1–5

1expert · hard
Your organization has a /16 network with multiple subnets. You need to detect scanning activity, but you have limited resources and cannot deploy sensors on every subnet. Which strategy is most effective for detecting scans across the entire network?
Select an answer first
2expert · hard
You need to discover live hosts on a network where the firewall drops ICMP and all TCP SYN packets to closed ports. However, the firewall allows TCP connections to open ports. Which host discovery technique is most likely to succeed?
Select an answer first
3application · easy
During the initial stages of an incident response, you need to understand which systems on the network are reachable and what services they expose. What is the primary purpose of performing network scanning in this context?
Select an answer first
4foundation · easy
Which evasion technique involves splitting a TCP packet into smaller fragments to bypass simple packet filters that inspect only the beginning of packets?
Select an answer first
5application · medium
After discovering an open port on a critical server, you need to identify the exact service and version running on that port to assess potential vulnerabilities. You have network access to the port but you want to minimize the risk of crashing the service. Which Nmap command is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.