During an incident investigation, you need to determine the operating system of a compromised host without sending any packets directly to that host. You have access to a network tap that captures traffic between the host and other systems. Which approach is most appropriate?

Analyze captured TCP/IP stack characteristics such as TTL and window size

Run Nmap with -O against the host's IP address

Perform a banner grab on port 80 using netcat

Use arp-scan to identify the host's MAC address and look up the OUI

You are conducting a penetration test against a network with a strict egress firewall that only allows outbound TCP connections to ports 80 and 443. You need to scan internal hosts from outside, but the firewall blocks all inbound traffic. Which technique could you use to perform the scan?

Use fragmented packets (-f) to evade the firewall

Use an idle scan (-sI) with a zombie on the internal network

Use a reverse connection through a compromised internal host

Use Nmap decoy scan (-D) to hide the source

You have Nmap output showing port 22 open with service 'ssh' and version 'OpenSSH 7.2p2'. You also see port 8080 open with service 'http-proxy'. You need to prioritize which service to investigate for a potential vulnerability. Which factor should most influence your decision?

The version of OpenSSH is outdated and has known vulnerabilities

Port 8080 is a non-standard port and therefore more suspicious

The SSH service is more critical because it is on a standard port

You should investigate both equally because both are open

GIAC Certified Incident Handler

Domain 5Objective 1

Scanning and Mapping GCIH Practice Questions (Page 9)

Part of the Network and Infrastructure Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 41–45

41application · medium
During an incident investigation, you need to determine the operating system of a compromised host without sending any packets directly to that host. You have access to a network tap that captures traffic between the host and other systems. Which approach is most appropriate?
Select an answer first
42foundation · easy
Which Nmap flag is used to perform a TCP SYN scan?
Select an answer first
43expert · hard
You are conducting a penetration test against a network with a strict egress firewall that only allows outbound TCP connections to ports 80 and 443. You need to scan internal hosts from outside, but the firewall blocks all inbound traffic. Which technique could you use to perform the scan?
Select an answer first
44foundation · easy
Which evasion technique uses multiple spoofed source IP addresses in addition to the real scanner's IP to confuse intrusion detection systems?
Select an answer first
45expert · hard
You have Nmap output showing port 22 open with service 'ssh' and version 'OpenSSH 7.2p2'. You also see port 8080 open with service 'http-proxy'. You need to prioritize which service to investigate for a potential vulnerability. Which factor should most influence your decision?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Scanning and Mapping GCIH Practice Questions (Page 9)

Questions 41–45

During an incident investigation, you need to determine the operating system of a compromised host without sending any packets directly to that host. You have access to a network tap that captures traffic between the host and other systems. Which approach is most appropriate?

Which Nmap flag is used to perform a TCP SYN scan?

You are conducting a penetration test against a network with a strict egress firewall that only allows outbound TCP connections to ports 80 and 443. You need to scan internal hosts from outside, but the firewall blocks all inbound traffic. Which technique could you use to perform the scan?

Which evasion technique uses multiple spoofed source IP addresses in addition to the real scanner's IP to confuse intrusion detection systems?

You have Nmap output showing port 22 open with service 'ssh' and version 'OpenSSH 7.2p2'. You also see port 8080 open with service 'http-proxy'. You need to prioritize which service to investigate for a potential vulnerability. Which factor should most influence your decision?

Keep studying — Network and Infrastructure Security