Certified Ethical Hacker Network Security and Scanning 2 — Questions and Answers
Question 1: Which Nmap scan type sends only a SYN packet and never completes the TCP handshake?
- TCP connect scan (-sT)
- SYN stealth scan (-sS) (Correct answer)
- ACK scan (-sA)
- FIN scan (-sF)
Correct answer: SYN stealth scan (-sS)
The SYN stealth scan sends a SYN and tears down the connection with RST before the handshake completes.
Question 2: A firewall responds to an Nmap ACK scan with no reply (filtered). What does this indicate?
- The port is open
- A stateful firewall is filtering the port (Correct answer)
- The host is offline
- The port is closed
Correct answer: A stateful firewall is filtering the port
An ACK scan maps firewall rules, and no response means a stateful firewall is filtering that port.
Question 3: Which protocol does a ping sweep typically use to identify live hosts?
- ICMP echo request (Correct answer)
- ARP cache poisoning
- DNS zone transfer
- SNMP walk
Correct answer: ICMP echo request
A ping sweep sends ICMP echo requests across a range to find responsive hosts.
Question 4: What is the purpose of an Nmap idle (zombie) scan?
- To flood the target with traffic
- To scan without revealing the attacker's IP by using a third host (Correct answer)
- To brute-force passwords
- To crash the target service
Correct answer: To scan without revealing the attacker's IP by using a third host
The idle scan spoofs packets via a zombie host so the target never sees the attacker's real IP.
Question 5: Which TCP flags are set in a packet during an Xmas scan?
- SYN, ACK, RST
- FIN, PSH, URG (Correct answer)
- SYN only
- ACK only
Correct answer: FIN, PSH, URG
An Xmas scan lights up the FIN, PSH, and URG flags like a Christmas tree.
Question 6: During OS fingerprinting, what value primarily helps distinguish operating systems?
- MAC address vendor only
- TCP/IP stack characteristics like TTL and window size (Correct answer)
- The hostname
- The DNS PTR record
Correct answer: TCP/IP stack characteristics like TTL and window size
Different OSes implement the TCP/IP stack with distinctive default TTL and window size values.
Question 7: What does the Nmap -sV flag accomplish?
- Detects service and version information on open ports (Correct answer)
- Performs a UDP scan
- Disables ping
- Runs a vulnerability exploit
Correct answer: Detects service and version information on open ports
The -sV flag probes open ports to determine the running service and its version.
Certified Ethical Hacker Network Security and Scanning 2
Which Nmap scan type sends only a SYN packet and never completes the TCP handshake?