You are performing a security assessment and need to identify the operating system of a remote host. The host is behind a firewall that drops all ICMP traffic and most TCP probes, but it allows HTTP traffic to port 80. Which technique is most likely to help you identify the OS?

Use Nmap's -O option with default settings

Analyze the HTTP response headers from the web server

Perform a UDP scan on common ports

Use a FIN scan to bypass the firewall

Which Nmap command performs host discovery by sending ICMP echo requests and TCP SYN packets to port 443?

nmap -sn -PE -PS443 192.168.1.0/24

Your organization wants to detect unauthorized port scans on the internal network. You have a limited budget and need a solution that can analyze network traffic in real time and alert on suspicious scanning patterns. Which approach should you implement?

Deploy a network intrusion detection system (NIDS) with signatures for common scan types

Install host-based antivirus on all endpoints

Enable logging on all firewalls and review logs weekly

You are performing a red-team exercise and need to identify the operating system of a target host. The target is behind a firewall that drops all ICMP and most TCP probes, but it allows HTTPS traffic. You have also captured some traffic from the target to other hosts on the network. Which combination of techniques is most likely to yield the OS information?

Active OS fingerprinting with Nmap -O using a decoy source

TCP FIN scan to bypass the firewall and then use Nmap -O

UDP scanning of common ports to elicit OS-specific responses

Passive fingerprinting of the captured traffic combined with analysis of HTTPS server headers

GIAC Certified Incident Handler

Domain 5Objective 1

Scanning and Mapping GCIH Practice Questions (Page 6)

Part of the Network and Infrastructure Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 26–30

26application · medium
You are performing a security assessment and need to identify the operating system of a remote host. The host is behind a firewall that drops all ICMP traffic and most TCP probes, but it allows HTTP traffic to port 80. Which technique is most likely to help you identify the OS?
Select an answer first
27foundation · easy
Which Nmap command performs host discovery by sending ICMP echo requests and TCP SYN packets to port 443?
Select an answer first
28foundation · easy
Which port scanning technique completes the full TCP three-way handshake and is known for being the most reliable but also the most detectable?
Select an answer first
29application · medium
Your organization wants to detect unauthorized port scans on the internal network. You have a limited budget and need a solution that can analyze network traffic in real time and alert on suspicious scanning patterns. Which approach should you implement?
Select an answer first
30expert · hard
You are performing a red-team exercise and need to identify the operating system of a target host. The target is behind a firewall that drops all ICMP and most TCP probes, but it allows HTTPS traffic. You have also captured some traffic from the target to other hosts on the network. Which combination of techniques is most likely to yield the OS information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Scanning and Mapping GCIH Practice Questions (Page 6)

Questions 26–30

You are performing a security assessment and need to identify the operating system of a remote host. The host is behind a firewall that drops all ICMP traffic and most TCP probes, but it allows HTTP traffic to port 80. Which technique is most likely to help you identify the OS?

Which Nmap command performs host discovery by sending ICMP echo requests and TCP SYN packets to port 443?

Which port scanning technique completes the full TCP three-way handshake and is known for being the most reliable but also the most detectable?

Your organization wants to detect unauthorized port scans on the internal network. You have a limited budget and need a solution that can analyze network traffic in real time and alert on suspicious scanning patterns. Which approach should you implement?

Keep studying — Network and Infrastructure Security