GIAC Penetration Tester (GPEN)
Domain 1Objective 3
Scanning and Host Discovery GPEN Practice Questions (Page 3)
Part of the Penetration Testing Foundations domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)
43questions here
9free pages
7concepts
Questions 11–15
- 11
A penetration tester is scanning a large network and wants to avoid detection by an intrusion detection system (IDS). The tester decides to send packets with a very small fragment size so that the TCP header is split across multiple packets. Which Nmap option accomplishes this?
Select an answer first - 12
Which Nmap option uses decoy IP addresses to hide the real source of a scan?
Select an answer first - 13
Which Nmap option is used to specify a custom list of ports to scan, such as 22,80,443?
Select an answer first - 14
A penetration tester is conducting a host discovery scan against a /24 subnet that is known to contain a mix of Windows and Linux hosts. The tester wants to identify live hosts quickly while minimizing the chance of being blocked by a stateful firewall that drops unsolicited inbound ICMP echo requests. Which Nmap command best achieves this?
Select an answer first - 15
A tester is conducting a SYN scan against a target and notices that the scan is being detected by the network IDS. The tester wants to reduce the chance of detection by slowing down the scan and sending packets less frequently. Which Nmap option should be used?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.