Question 1

Which of the following describes a text file containing multiple commands that would usually be entered manually at the command prompt?
A) script
B) port-scanner
C) application
D) configuration file

Accepted Answer

A script is a file containing multiple commands that can be executed in a batch rather than entering each command manually at the command prompt. The other options do not fit this description.

Question 2

If an attacker decides to implement a less obvious port-scan,or stealth attack,which of the following techniques would be appropriate to make their activities more difficult to detect?
A) increase their scan speeds
B) limit their tool set
C) increase their scan speeds.
D) limit their scan speeds

Accepted Answer

The best choice to make a stealth attack more difficult to detect is to limit the scan speeds. This will make it harder for network intrusion detection systems to detect the scan activity as it will appear more like legitimate network traffic. Increasing the scan speeds or limiting the tool set may actually make the attacker more noticeable as it could generate more network traffic or use suspicious tools that are commonly associated with malicious activity.

Question 3

Which of the following describes a flexible program that automates a task that takes too much time to perform manually?
A) Nmap
B) open source utility
C) customized script
D) Fping

Accepted Answer

A customized script is specifically designed to automate a particular task or set of tasks that would take too much time to perform manually. This type of program can be tailored to meet the exact needs of the user and can be updated as needed. Nmap, Fping, and open source utilities are all examples of software applications, but they do not necessarily provide the level of flexibility and customization that a customized script can offer.

Question 4

What advanced port-scanning tool can allow a security tester to bypass filtering devices by injecting crafted or otherwise modified IP-packets into a network?
A) Hping
B) NetTools
C) Nessus
D) Nmap

Accepted Answer

Hping allows a security tester to craft or modify IP packets and send them out on the network. This can help to bypass filtering devices in order to find open ports on a target system. Nessus and Nmap are both port-scanning tools, but they do not have the same level of packet manipulation capabilities as Hping. NetTools is not typically used for advanced port scanning or packet manipulation.

Question 5

Attackers typically use ACK scans to get past a firewall or other filtering devices.

Accepted Answer

ACK scans are used to determine if a firewall or filtering device is present and which ports may be open for communication. Attackers use this information to bypass the security measures in place and gain access to a network.

Question 6

When security professionals create a packet,they may choose to specifically set which of the following fields to help initiate a response from a target computer?
A) box
B) flag
C) open
D) id

Accepted Answer

The field that security professionals may choose to specifically set to help initiate a response from a target computer is the flag field. This field contains various bits that can be toggled to request specific actions or indicate particular conditions to the recipient computer. For example, setting the SYN bit in the flag field can initiate a TCP handshake, while setting the RST bit can indicate that a connection should be terminated immediately.

Question 7

What open-source network utility allows you to use plug-ins to run test programs (scripts)that can be selected from the client interface?
A) Uniscan
B) Fping
C) Nessus
D) OpenVAS

Accepted Answer

OpenVAS allows the use of plug-ins which are essentially scripts that can be selected and run from the client interface. Uniscan, Fping, and Nessus do not have this feature.

Question 8

What type of port scan has the FIN,PSH,and URG flags set?
A) NULL scan
B) connect scan
C) XMAS scan
D) ACK scan

Accepted Answer

A FIN/PSH/URG scan is also known as an XMAS scan. This type of port scan sets the FIN, PSH, and URG flags in the TCP header to determine which ports are open on a target system. This scan is considered stealthy because it does not set any of the standard flags (SYN, ACK, or RST), which could trigger a response from a firewall or intrusion detection system.

Question 9

An open port allows access to specific applications and cannot be vulnerable to attack.

Accepted Answer

An open port allows access to specific applications, but it can also be vulnerable to attack if it is not properly secured or configured. Attackers can use open ports to gain unauthorized access to a network or system, so it is important to carefully manage and monitor them.

Question 10

What open source port-scanning tool is considered to be the standard port-scanning tool for security professionals?
A) NULL
B) NMap
C) NScanner
D) PortGhost

Accepted Answer

NMap is considered to be the standard port-scanning tool for security professionals due to its robustness, flexibility, and extensive feature set. It is actively developed and maintained, supports a wide range of operating systems, protocols, and scan types, and has a large user community providing support and sharing knowledge. Additionally, NMap can be extended and customized via scripts and plugins, making it a versatile tool for both simple and complex scanning tasks.

Question 11

You can search for vulnerabilities in a host computer by using a port-scanning tool.

Accepted Answer

Port-scanning tools can be used to identify open ports on a host computer, which can reveal potential vulnerabilities that could be exploited by hackers.

Question 12

What network security tool,usually included with Kali Linux,allows a user to ping multiple IP addresses?
A) Nmap
B) Fping
C) Tcpdump
D) Nessus

Accepted Answer

Fping is a network security tool included in Kali Linux that allows a user to ping multiple IP addresses. Nmap is primarily used for port scanning and detecting network vulnerabilities. Tcpdump is a packet analyzer and Nessus is a vulnerability scanner, neither of which have the specific capability to ping multiple IP addresses.

Question 13

Closed ports respond to a NULL scan with what type of packet?
A) RST
B) SYN
C) Ping
D) ACK

Accepted Answer

Closed ports respond to a NULL scan with an RST packet, as this is the usual response of a port that is not listening for connections. SYN packets are sent to open ports as part of the three-way handshake process, ping is not a response for a NULL scan and ACK packets are usually sent as a response to an established connection.

Question 14

In a normal TCP session,the sender sends a packet to another computer with which of the following flags set?
A) SYN/ACK flag
B) SYN flag
C) No flag
D) Reset flag

Accepted Answer

In a normal TCP session, the sender sends a packet with the SYN flag set to initiate the connection. This is known as the SYN packet.

Question 15

In a NULL scan,all packet flags are turned on.

Accepted Answer

In a NULL scan, all packet flags are turned off. This is done to gather information about the target system's response to a packet with no flags set.

Question 16

Port scanning is a method of finding out which services a host computer offers.

Accepted Answer

Port scanning involves scanning a range of ports on a host computer to detect which ones are open and which services are running on them. This allows an attacker to identify potential vulnerabilities and weaknesses in the target system.

Question 17

When a TCP three-way handshake ends,both parties send what type of packet to end the connection?
A) SYN
B) ACK
C) FIN
D) RST

Accepted Answer

When a TCP three-way handshake ends, both parties send a FIN packet to end the connection. The FIN (finish) packet is used to terminate an active connection. The FIN packet indicates that the sender has no more data to send.

Question 18

In an ACK scan,if the attacked port returns an RST packet the attacked port is considered to be operating in what state?
A) open
B) closed
C) unfiltered
D) unassigned

Accepted Answer

In an ACK scan, if an RST packet is returned, it indicates that the port is unfiltered, meaning it is not blocked by a firewall but its state (open or closed) cannot be determined.

Question 19

What type of port scan is similar to a SYN scan and is risky to use because it relies on the attacked computer's OS?
A) XMAS
B) ACK
C) NULL
D) Connect

Accepted Answer

Connect scans are similar to SYN scans but are considered riskier because they complete the TCP handshake process, making the scan more detectable. This method relies on the operating system's built-in mechanisms to establish a connection, which can vary in behavior and response, making it dependent on the targeted system's OS.

Question 20

When using a port-scanner,what procedure can be conducted to identify which IP addresses belong to active hosts?
A) ping sweep
B) ping check
C) network sweep
D) ICMP probing

Accepted Answer

A ping sweep is the best way to identify which IP addresses belong to active hosts. It sends ICMP Echo Request packets to a range of IP addresses, and if it receives an ICMP Echo Response packet, it knows that the IP address is active and belongs to a live host. This can help to narrow down the scope of the port scan to only active hosts, saving time and resources.

Quiz 5: Port Scanning

Which of the following describes a text file containing multiple commands that would usually be entered manually at the command prompt?

If an attacker decides to implement a less obvious port-scan,or stealth attack,which of the following techniques would be appropriate to make their activities more difficult to detect?

Which of the following describes a flexible program that automates a task that takes too much time to perform manually?

What advanced port-scanning tool can allow a security tester to bypass filtering devices by injecting crafted or otherwise modified IP-packets into a network?

Attackers typically use ACK scans to get past a firewall or other filtering devices.

When security professionals create a packet,they may choose to specifically set which of the following fields to help initiate a response from a target computer?

What open-source network utility allows you to use plug-ins to run test programs (scripts) that can be selected from the client interface?

What type of port scan has the FIN,PSH,and URG flags set?

An open port allows access to specific applications and cannot be vulnerable to attack.

What open source port-scanning tool is considered to be the standard port-scanning tool for security professionals?

You can search for vulnerabilities in a host computer by using a port-scanning tool.

What network security tool,usually included with Kali Linux,allows a user to ping multiple IP addresses?

Closed ports respond to a NULL scan with what type of packet?

In a normal TCP session,the sender sends a packet to another computer with which of the following flags set?

In a NULL scan,all packet flags are turned on.

Port scanning is a method of finding out which services a host computer offers.

When a TCP three-way handshake ends,both parties send what type of packet to end the connection?

In an ACK scan,if the attacked port returns an RST packet the attacked port is considered to be operating in what state?

What type of port scan is similar to a SYN scan and is risky to use because it relies on the attacked computer's OS?

When using a port-scanner,what procedure can be conducted to identify which IP addresses belong to active hosts?