A tester runs a SYN scan against a target and receives the following output: '22/tcp open ssh', '80/tcp open http', '443/tcp open https', '8080/tcp open http-proxy'. The tester then runs a version detection scan on all open ports and finds that port 8080 is running an outdated version of Apache Tomcat that has a known remote code execution vulnerability. Which of the following is the most appropriate next step?

Run a full port scan on all 65535 ports.

Perform OS fingerprinting on the target.

Attempt to exploit the Tomcat vulnerability to gain access.

Report the vulnerability without attempting exploitation.

When interpreting Nmap scan results, which finding would be most valuable for identifying a potential entry point?

An open port with a current service version

An open port running an outdated service version

A filtered port that is blocked by a firewall

GIAC Penetration Tester (GPEN)

Domain 1Objective 3

Scanning and Host Discovery GPEN Practice Questions (Page 4)

Part of the Penetration Testing Foundations domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 16–20

16foundation · easy
Which Nmap option is used to enable service version detection?
Select an answer first
17expert · hard
A tester runs a SYN scan against a target and receives the following output: '22/tcp open ssh', '80/tcp open http', '443/tcp open https', '8080/tcp open http-proxy'. The tester then runs a version detection scan on all open ports and finds that port 8080 is running an outdated version of Apache Tomcat that has a known remote code execution vulnerability. Which of the following is the most appropriate next step?
Select an answer first
18application · medium
A tester is performing an OS fingerprint on a target and receives the following responses: the target responds to TCP SYN packets with a window size of 16384, does not set the DF flag, and uses a TTL of 128. Which operating system is most likely running on the target?
Select an answer first
19foundation · easy
Which Nmap command performs a SYN scan on all 65535 TCP ports of a target?
Select an answer first
20foundation · easy
When interpreting Nmap scan results, which finding would be most valuable for identifying a potential entry point?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Scanning and Host Discovery GPEN Practice Questions (Page 4)

Questions 16–20

Which Nmap option is used to enable service version detection?

A tester is performing an OS fingerprint on a target and receives the following responses: the target responds to TCP SYN packets with a window size of 16384, does not set the DF flag, and uses a TTL of 128. Which operating system is most likely running on the target?

Which Nmap command performs a SYN scan on all 65535 TCP ports of a target?

When interpreting Nmap scan results, which finding would be most valuable for identifying a potential entry point?

Keep studying — Penetration Testing Foundations