What information is typically obtained from a banner grab during service version detection?

The MAC address of the target host

The list of all open ports on the target

The operating system kernel version

The software name and version running on the open port

You are responding to an incident where an attacker has compromised a server. You need to identify the operating system of the attacker's machine from a pcap capture, but you cannot send any traffic to the attacker. Which technique is most appropriate?

Passive OS fingerprinting using TTL and TCP window size from the pcap

Using the source MAC address to identify the OS

Active OS fingerprinting with Nmap -O against the attacker's IP

Banner grabbing from the pcap's HTTP responses

You are on a local Ethernet segment and need to discover live hosts quickly. You have Nmap installed and you are concerned about being detected by the network's IDS, which is known to alert on ICMP and TCP SYN traffic. Which Nmap host discovery technique is most appropriate in this situation?

nmap -sS -p 1-1000 192.168.1.0/24

nmap -sn -PS22,80 192.168.1.0/24

You have captured a pcap file from a suspected compromised host. You need to identify which services were likely running on the host based on the traffic. Which approach is most appropriate?

Use a port scanner on the pcap file itself

Analyze the pcap for TCP handshakes to common ports and banner responses

Run an active Nmap scan against the host's IP from the pcap

You are analyzing a service that returns a banner saying '220 FTP server ready' but does not respond to standard FTP commands. You need to determine the actual service behind the banner. Which technique is most appropriate?

Perform a full port scan to see if other ports are open

Use Nmap version detection (-sV) with aggressive probes

Use a UDP scan on the same port

Trust the banner and assume it is an FTP server

GIAC Certified Incident Handler

Domain 5Objective 1

Scanning and Mapping GCIH Practice Questions (Page 5)

Part of the Network and Infrastructure Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 21–25

21foundation · easy
What information is typically obtained from a banner grab during service version detection?
Select an answer first
22expert · hard
You are responding to an incident where an attacker has compromised a server. You need to identify the operating system of the attacker's machine from a pcap capture, but you cannot send any traffic to the attacker. Which technique is most appropriate?
Select an answer first
23application · medium
You are on a local Ethernet segment and need to discover live hosts quickly. You have Nmap installed and you are concerned about being detected by the network's IDS, which is known to alert on ICMP and TCP SYN traffic. Which Nmap host discovery technique is most appropriate in this situation?
Select an answer first
24application · medium
You have captured a pcap file from a suspected compromised host. You need to identify which services were likely running on the host based on the traffic. Which approach is most appropriate?
Select an answer first
25expert · hard
You are analyzing a service that returns a banner saying '220 FTP server ready' but does not respond to standard FTP commands. You need to determine the actual service behind the banner. Which technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.