You are investigating a suspicious host on your network. You need to determine its operating system without sending any packets to the host, to avoid alerting the attacker. Which technique should you use?

Active OS fingerprinting with Nmap -O

Passive OS fingerprinting by capturing traffic

In the context of incident handling, what is the primary purpose of network scanning?

To block malicious traffic by updating firewall rules on the target network.

To automatically patch vulnerabilities found on target systems.

To establish a secure encrypted channel between the incident handler and the target host.

To identify active hosts, open ports, and running services on a network to understand the attack surface.

Your organization has experienced several unauthorized port scans from the internet. You want to implement a defensive measure that can detect and potentially block these scans at the network perimeter. Which of the following is the most effective approach?

Use a honeypot to attract scans and log attacker activity

Configure the firewall to drop all inbound SYN packets

Disable ICMP echo replies on all servers

Deploy an intrusion prevention system (IPS) with a rule to block source IPs that send SYN packets to multiple ports within a short time

GIAC Certified Incident Handler

Domain 5Objective 1

Scanning and Mapping GCIH Practice Questions (Page 3)

Part of the Network and Infrastructure Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 11–15

11application · medium
You are investigating a suspicious host on your network. You need to determine its operating system without sending any packets to the host, to avoid alerting the attacker. Which technique should you use?
Select an answer first
12foundation · easy
In the context of incident handling, what is the primary purpose of network scanning?
Select an answer first
13foundation · easy
Which host discovery technique relies on the Address Resolution Protocol (ARP) and is most effective on a local Ethernet network?
Select an answer first
14foundation · easy
During the incident handling process, which phase typically involves network scanning to gather information about the victim environment?
Select an answer first
15application · medium
Your organization has experienced several unauthorized port scans from the internet. You want to implement a defensive measure that can detect and potentially block these scans at the network perimeter. Which of the following is the most effective approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Scanning and Mapping GCIH Practice Questions (Page 3)

Questions 11–15

You are investigating a suspicious host on your network. You need to determine its operating system without sending any packets to the host, to avoid alerting the attacker. Which technique should you use?

In the context of incident handling, what is the primary purpose of network scanning?

Which host discovery technique relies on the Address Resolution Protocol (ARP) and is most effective on a local Ethernet network?

During the incident handling process, which phase typically involves network scanning to gather information about the victim environment?

Your organization has experienced several unauthorized port scans from the internet. You want to implement a defensive measure that can detect and potentially block these scans at the network perimeter. Which of the following is the most effective approach?

Keep studying — Network and Infrastructure Security