Certified Ethical Hacker Network Security and Scanning 3 — Questions and Answers
Question 1: Which scanning technique uses banner grabbing to gather information?
- Connecting to a service to read its response header (Correct answer)
- Sending malformed ICMP packets
- Poisoning the ARP table
- Spoofing the source MAC
Correct answer: Connecting to a service to read its response header
Banner grabbing connects to a service (e.g., via Telnet or netcat) to read identifying header text.
Question 2: Why is a UDP scan generally slower and less reliable than a TCP scan?
- UDP encrypts all packets
- UDP is connectionless and open ports often send no response (Correct answer)
- UDP requires authentication
- UDP uses a three-way handshake
Correct answer: UDP is connectionless and open ports often send no response
UDP is connectionless, so open ports frequently stay silent, forcing slow timeout-based inference.
Question 3: What is the main goal of network enumeration after scanning?
- To extract usernames, shares, and services from identified hosts (Correct answer)
- To encrypt the target's disk
- To physically locate the server
- To register a new domain
Correct answer: To extract usernames, shares, and services from identified hosts
Enumeration actively extracts resources like usernames, shares, and services from discovered systems.
Question 4: Which tool is commonly used to capture and analyze network packets?
- Wireshark (Correct answer)
- Nessus
- Metasploit
- John the Ripper
Correct answer: Wireshark
Wireshark is a packet capture and protocol analyzer used to inspect network traffic.
Question 5: An attacker performs a DNS zone transfer (AXFR). What is the risk if it succeeds?
- The attacker can reset all passwords
- The full list of DNS records for the domain is exposed (Correct answer)
- The web server crashes
- All emails are intercepted
Correct answer: The full list of DNS records for the domain is exposed
A successful zone transfer hands over the complete DNS records, revealing internal hostnames and structure.
Question 6: What does TTL (Time To Live) manipulation help an attacker achieve?
- Evading some IDS by controlling packet hop expiration (Correct answer)
- Encrypting payloads
- Bypassing all firewalls automatically
- Speeding up DNS resolution
Correct answer: Evading some IDS by controlling packet hop expiration
Crafting TTL values can cause packets to expire before reaching the IDS, aiding evasion.
Question 7: Which Nmap timing template is the most aggressive and fastest?
- -T0 (paranoid)
- -T2 (polite)
- -T5 (insane) (Correct answer)
- -T3 (normal)
Correct answer: -T5 (insane)
-T5 (insane) is the fastest, most aggressive timing template at the cost of accuracy and stealth.
Certified Ethical Hacker Network Security and Scanning 3
Which scanning technique uses banner grabbing to gather information?