A penetration tester is conducting a SYN scan against a target and wants to evade a network-based IDS that is configured to alert on scans with a high packet rate. The tester also needs to ensure that the scan results are accurate and that the scan completes within a reasonable time. Which approach best balances stealth and efficiency?

Use -S with a spoofed source IP.

Use -T2 timing and -D with a few decoys.

Use -f to fragment all packets.

GIAC Penetration Tester (GPEN)

Domain 1Objective 3

Scanning and Host Discovery GPEN Practice Questions (Page 7)

Part of the Penetration Testing Foundations domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 31–35

31application · medium
A tester needs to perform a quick host discovery on a large network segment and wants to use a method that is fast and does not require administrative privileges. Which Nmap command should be used?
Select an answer first
32foundation · easy
Which Nmap option is used to fragment packets so that they are split into smaller pieces to evade simple packet-filtering firewalls?
Select an answer first
33application · medium
During an internal penetration test, a tester needs to identify which TCP ports are open on a Windows server. The tester does not have administrative privileges on the scanning machine and must ensure the scan completes quickly. Which Nmap scan type should be used?
Select an answer first
34application · medium
A penetration tester is scanning a target and needs to identify the operating system to tailor subsequent exploits. The tester has already performed a port scan and knows that port 80 is open. Which Nmap command should the tester use to identify the OS?
Select an answer first
35expert · hard
A penetration tester is conducting a SYN scan against a target and wants to evade a network-based IDS that is configured to alert on scans with a high packet rate. The tester also needs to ensure that the scan results are accurate and that the scan completes within a reasonable time. Which approach best balances stealth and efficiency?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Scanning and Host Discovery GPEN Practice Questions (Page 7)

Questions 31–35

A tester needs to perform a quick host discovery on a large network segment and wants to use a method that is fast and does not require administrative privileges. Which Nmap command should be used?

Which Nmap option is used to fragment packets so that they are split into smaller pieces to evade simple packet-filtering firewalls?

During an internal penetration test, a tester needs to identify which TCP ports are open on a Windows server. The tester does not have administrative privileges on the scanning machine and must ensure the scan completes quickly. Which Nmap scan type should be used?

A penetration tester is scanning a target and needs to identify the operating system to tailor subsequent exploits. The tester has already performed a port scan and knows that port 80 is open. Which Nmap command should the tester use to identify the OS?

Keep studying — Penetration Testing Foundations