A penetration tester is conducting a network scan of a target that has a host-based firewall that only allows inbound traffic from specific IP addresses. The tester wants to identify open ports without being blocked. Which technique is most likely to succeed?

Use a TCP connect scan from a proxy that is allowed by the firewall.

Use a UDP scan from a spoofed IP address that is allowed by the firewall.

Use a TCP SYN scan with the source port set to 80 to bypass the firewall.

Use a TCP SYN scan from a spoofed IP address that is allowed by the firewall.

A penetration tester has identified an open port on a target server. The tester needs to determine the service and version to check for known vulnerabilities. The tester has access to a vulnerability database but needs to know the exact version. Which action should the tester take?

Perform a UDP scan on the same port to see if the service responds differently.

Guess the version based on the port number.

Use a service fingerprinting tool to send probes and compare responses to a database of known service signatures.

Run a vulnerability scanner without specifying the service version.

A vulnerability management team is evaluating two vulnerability scanners for a large enterprise environment. Scanner A uses a traditional signature-based approach and produces a high number of false positives. Scanner B uses an AI-enhanced approach that learns from the organization's patch history and reduces false positives but requires a longer scan time. The team needs to scan a critical production network during a short maintenance window and must minimize false positives to avoid alert fatigue. Which scanner should the team choose?

Scanner A, because it is faster and can complete the scan within the maintenance window.

Scanner B, because the reduced false positives are more valuable than the longer scan time, even if it means the scan may not fully complete.

Use Scanner B but limit the scan to the most critical hosts to fit the maintenance window.

Use Scanner A for a quick scan and then use Scanner B to verify the findings.

GIAC Offensive AI Analyst

Domain 2Objective 2

Network Scanning and Vulnerability Detection GOAA Practice Questions (Page 1)

Part of the AI-Driven Offensive Operations domain, which makes up ~40% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~20–32 in this domain), expect 5–8 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 1–5

1expert · hard
A penetration tester is conducting a network scan of a target that has a host-based firewall that only allows inbound traffic from specific IP addresses. The tester wants to identify open ports without being blocked. Which technique is most likely to succeed?
Select an answer first
2application · medium
A penetration tester has identified an open port on a target server. The tester needs to determine the service and version to check for known vulnerabilities. The tester has access to a vulnerability database but needs to know the exact version. Which action should the tester take?
Select an answer first
3expert · hard
A vulnerability management team is evaluating two vulnerability scanners for a large enterprise environment. Scanner A uses a traditional signature-based approach and produces a high number of false positives. Scanner B uses an AI-enhanced approach that learns from the organization's patch history and reduces false positives but requires a longer scan time. The team needs to scan a critical production network during a short maintenance window and must minimize false positives to avoid alert fatigue. Which scanner should the team choose?
Select an answer first
4foundation · easy
A security analyst wants to identify open UDP ports on a target host. Which scanning technique is designed for this purpose?
Select an answer first
5foundation · easy
Which tool is commonly used for both port scanning and service/version detection, and is often considered a standard utility in offensive operations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOAA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOAA” is a trademark of its owner, used for identification only.

Network Scanning and Vulnerability Detection GOAA Practice Questions (Page 1)

Questions 1–5

A penetration tester is conducting a network scan of a target that has a host-based firewall that only allows inbound traffic from specific IP addresses. The tester wants to identify open ports without being blocked. Which technique is most likely to succeed?

A penetration tester has identified an open port on a target server. The tester needs to determine the service and version to check for known vulnerabilities. The tester has access to a vulnerability database but needs to know the exact version. Which action should the tester take?

A security analyst wants to identify open UDP ports on a target host. Which scanning technique is designed for this purpose?

Which tool is commonly used for both port scanning and service/version detection, and is often considered a standard utility in offensive operations?

Keep studying — AI-Driven Offensive Operations