Certified Ethical Hacker Network Security and Scanning 2

Question 1

Which Nmap scan type sends only a SYN packet and never completes the TCP handshake?

Accepted Answer

SYN stealth scan (-sS)

Answer

TCP connect scan (-sT)

Answer

ACK scan (-sA)

Answer

FIN scan (-sF)

Question 2

A firewall responds to an Nmap ACK scan with no reply (filtered). What does this indicate?

Accepted Answer

A stateful firewall is filtering the port

Answer

The port is open

Answer

The host is offline

Answer

The port is closed

Question 3

Which protocol does a ping sweep typically use to identify live hosts?

Accepted Answer

ICMP echo request

Answer

ARP cache poisoning

Answer

DNS zone transfer

Answer

SNMP walk

Question 4

What is the purpose of an Nmap idle (zombie) scan?

Accepted Answer

To scan without revealing the attacker's IP by using a third host

Answer

To flood the target with traffic

Answer

To brute-force passwords

Answer

To crash the target service

Question 5

Which TCP flags are set in a packet during an Xmas scan?

Accepted Answer

FIN, PSH, URG

Answer

SYN, ACK, RST

Answer

SYN only

Answer

ACK only

Question 6

During OS fingerprinting, what value primarily helps distinguish operating systems?

Accepted Answer

TCP/IP stack characteristics like TTL and window size

Answer

MAC address vendor only

Answer

The hostname

Answer

The DNS PTR record

Question 7

What does the Nmap -sV flag accomplish?

Accepted Answer

Detects service and version information on open ports

Answer

Performs a UDP scan

Answer

Disables ping

Answer

Runs a vulnerability exploit