Scanning and Host Discovery GPEN Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A penetration tester is scanning a large network and wants to avoid detection by an IDS that is configured to alert on scans that hit more than 100 ports on a single host. The tester needs to scan all 65535 TCP ports on a specific host. Which approach is most likely to avoid triggering the alert?

   • AUse a SYN scan with -T2 timing and randomize the port order.
   • BUse a TCP connect scan with -T5 timing.
   • CUse a UDP scan with -T2 timing.
   • DUse a FIN scan with -T1 timing.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A penetration tester is engaged to assess a network segment that contains both Linux and Windows hosts. The client explicitly requests that the tester avoid ICMP echo requests because the IDS alerts on them. The tester needs to identify live hosts quickly and then move to port scanning. Which Nmap command best achieves host discovery while respecting the client's constraint?

   • Anmap -sn -PU53 192.168.10.0/24
   • Bnmap -sn -PS22,80,443 -T4 192.168.10.0/24
   • Cnmap -sS -p 1-65535 192.168.10.0/24
   • Dnmap -sn -PE -T4 192.168.10.0/24
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A penetration tester is scanning a target that is protected by an IDS that is configured to alert on any scan that sends more than 10 packets per second from a single source. The tester needs to complete a port scan of 1000 ports, but the client has asked the tester to avoid triggering the IDS. Which approach best balances stealth and completion time?

   • AUse Nmap with -T5 to complete the scan quickly before the IDS can alert.
   • BUse Nmap with -T2 and -D RND:5 to slow the scan and use decoys.
   • CUse Nmap with -sS to perform a SYN scan, which is stealthier and will not trigger the IDS.
   • DUse Nmap with -f to fragment the packets, which will evade the IDS.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During a scan, a tester receives responses from a target that include TCP options such as window scaling and selective ACK, and the initial TTL is 64. The tester also notices that the target responds to ICMP echo requests with a payload that is exactly the same as the request. Based on these characteristics, which operating system family is most likely running on the target?

   • ALinux
   • BWindows
   • CCisco IOS
   • DmacOS
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which ICMP message type is most commonly used in a standard ping sweep to discover live hosts on an IPv4 network?

   • AEcho Request (type 8)
   • BRedirect (type 5)
   • CDestination Unreachable (type 3)
   • DTimestamp Request (type 13)
   Reveal Solution Discussion Select an answer first