Network Scanning and Vulnerability Detection GOAA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An offensive security team is planning a network scan of a target environment that includes both internal and external hosts. The team wants to minimize the chance of being detected by intrusion detection systems (IDS) while still gathering enough information to plan an attack. Which combination of scanning phases and techniques should the team use?

   • ASkip the discovery phase and directly run a vulnerability scanner against the entire IP range.
   • BUse a SYN scan to identify open ports, then use an AI-based tool to analyze the responses and predict which services are running without sending additional probes.
   • CPerform a UDP scan on all ports first, then use a vulnerability scanner to confirm the findings.
   • DStart with a ping sweep to identify live hosts, then perform a full TCP connect scan on all ports of each live host.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security consultant is performing an internal penetration test and has identified an open port on a server. The consultant needs to determine the exact version of the service running to check for known vulnerabilities. The service is not responding to standard banner-grabbing requests. Which technique should the consultant use to identify the service version?

   • ASend a series of crafted probes that elicit different responses based on the service implementation, and compare them to a fingerprint database.
   • BUse a UDP scan on the same port to see if the service responds differently.
   • CRun a full port scan with the -A flag to enable OS detection and version detection.
   • DCheck the service's default port number and assume it is the latest version.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   A scan report shows a critical vulnerability on a web server that is exposed to the internet, and a medium vulnerability on an internal database server. Which action is most appropriate?

   • AAddress both simultaneously without prioritization
   • BIgnore both because they are not exploitable
   • CPrioritize the medium vulnerability because internal servers are more valuable
   • DPrioritize the critical vulnerability on the internet-facing server due to higher exposure
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A penetration tester is scanning a target and finds an open port 22. The tester wants to know the SSH server version. Which nmap command should be used?

   • Anmap -p 22 <target>
   • Bnmap -O -p 22 <target>
   • Cnmap -sV -p 22 <target>
   • Dnmap -sS -p 22 <target>
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security team wants to automate the discovery of new devices on their network and identify potential vulnerabilities. They have a large environment with frequent changes. Which AI technique would be most effective for this task?

   • AUse a supervised learning model trained on historical vulnerability data to predict new vulnerabilities.
   • BUse an unsupervised learning model to cluster devices based on their open ports and services, then flag anomalies.
   • CUse a manual process to inventory devices and check for vulnerabilities.
   • DUse a rule-based system that scans for known vulnerabilities.
   Reveal Solution Discussion Select an answer first