Scanning and Host Discovery GPEN Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During an internal penetration test, a tester needs to identify open TCP ports on a critical server. The client has asked the tester to minimize the chance of the scan being logged by the host's application-level firewall. The tester has root privileges on the scanning machine. Which scan type should the tester use?

   • AACK scan (-sA)
   • BSYN scan (-sS)
   • CUDP scan (-sU)
   • DTCP connect scan (-sT)
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A penetration tester is performing OS fingerprinting on a target and receives a response that suggests the target is running a Linux distribution. The tester wants to confirm the OS guess with additional probes. Which Nmap option should the tester use to increase the accuracy of OS detection?

   • Anmap -O --osscan-guess target
   • Bnmap -sV target
   • Cnmap -sS target
   • Dnmap -A target
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A penetration tester has discovered an open port on a web server and needs to determine the exact version of the service to check for known vulnerabilities. The tester wants to avoid crashing the service and wants a reliable version identification. Which Nmap command should the tester use?

   • Anmap -sU -p 443 target
   • Bnmap -sS -p 443 target
   • Cnmap -O -p 443 target
   • Dnmap -sV --version-intensity 7 -p 443 target
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A penetration tester is performing an internal scan of a critical server. The server's host-based firewall is configured to log all established TCP connections, but it does not log incomplete handshakes. The tester needs to identify open TCP ports, but the client has asked the tester to avoid generating logs on the target. Which scan type should the tester use, and why?

   • ASYN scan (-sS), because it does not complete the handshake and will not be logged by the firewall.
   • BACK scan (-sA), because it does not complete a handshake and will not be logged.
   • CUDP scan (-sU), because it does not complete a handshake and will not be logged.
   • DTCP connect scan (-sT), because it is more reliable and the firewall will not log it.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A tester is performing a port scan on a target and wants to avoid detection by a firewall that is configured to drop packets with the SYN flag set. The tester still needs to identify open TCP ports. Which scan type is most likely to succeed?

   • ATCP connect scan (-sT)
   • BSYN scan (-sS)
   • CUDP scan (-sU)
   • DFIN scan (-sF)
   Reveal Solution Discussion Select an answer first