You are leading an incident response team that has been called in to investigate a suspected breach on a critical network segment. The network contains both production servers and legacy devices that are known to crash under certain types of network traffic. You need to perform scanning and mapping to understand the environment, but you must minimize the risk of disrupting operations. Which approach best balances the need for information with the need for stability?

Immediately run a comprehensive vulnerability scanner with default settings across the entire segment

Use a UDP scan first to avoid TCP-based crashes, then follow with a TCP connect scan

Perform a full SYN scan of all ports on all hosts using Nmap's -T5 timing template

Start with passive traffic analysis and then conduct a slow, low-intensity scan of only the most critical hosts

What can be inferred from a Nmap scan that shows multiple hosts with the same open ports and similar service versions?

The hosts may be part of a standardized server farm or deployment

The hosts are running different operating systems

The hosts are definitely compromised

The hosts are all virtual machines

Which defensive measure is specifically designed to detect unauthorized port scanning by monitoring for multiple connection attempts to different ports on the same host?

Intrusion Detection System (IDS)

When analyzing Nmap output, what does a port status of 'open' indicate?

The port is closed but no service is listening

A service is actively accepting connections on that port

The port is filtered by a firewall

You have performed a scan of a network segment and obtained the following results: Host A: 192.168.1.10, open ports 22, 80, 443 Host B: 192.168.1.11, open ports 22, 3306 Host C: 192.168.1.12, open ports 80, 443, 8080 Which of the following is the most reasonable interpretation of this scan data?

Host A is a database server, Host B is a web server, and Host C is a mail server.

Host C is likely a file server because it has port 8080 open.

All three hosts are running the same operating system.

Host A is likely a web server, Host B is likely a database server, and Host C is likely a web application server.

GIAC Certified Incident Handler

Domain 5Objective 1

Scanning and Mapping GCIH Practice Questions (Page 8)

Part of the Network and Infrastructure Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 36–40

36expert · hard
You are leading an incident response team that has been called in to investigate a suspected breach on a critical network segment. The network contains both production servers and legacy devices that are known to crash under certain types of network traffic. You need to perform scanning and mapping to understand the environment, but you must minimize the risk of disrupting operations. Which approach best balances the need for information with the need for stability?
Select an answer first
37foundation · easy
What can be inferred from a Nmap scan that shows multiple hosts with the same open ports and similar service versions?
Select an answer first
38foundation · easy
Which defensive measure is specifically designed to detect unauthorized port scanning by monitoring for multiple connection attempts to different ports on the same host?
Select an answer first
39foundation · easy
When analyzing Nmap output, what does a port status of 'open' indicate?
Select an answer first
40application · medium
You have performed a scan of a network segment and obtained the following results: Host A: 192.168.1.10, open ports 22, 80, 443 Host B: 192.168.1.11, open ports 22, 3306 Host C: 192.168.1.12, open ports 80, 443, 8080 Which of the following is the most reasonable interpretation of this scan data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.