Certified Ethical Hacker Network Security and Scanning 2

Question 1

Which Nmap scan type sends only a SYN packet and never completes the TCP handshake?

Accepted Answer

SYN stealth scan (-sS)

Answer

The SYN stealth scan sends a SYN and tears down the connection with RST before the handshake completes.

Question 2

A firewall responds to an Nmap ACK scan with no reply (filtered). What does this indicate?

Accepted Answer

A stateful firewall is filtering the port

Answer

An ACK scan maps firewall rules, and no response means a stateful firewall is filtering that port.

Question 3

Which protocol does a ping sweep typically use to identify live hosts?

Accepted Answer

ICMP echo request

Answer

A ping sweep sends ICMP echo requests across a range to find responsive hosts.

Question 4

What is the purpose of an Nmap idle (zombie) scan?

Accepted Answer

To scan without revealing the attacker's IP by using a third host

Answer

The idle scan spoofs packets via a zombie host so the target never sees the attacker's real IP.

Question 5

Which TCP flags are set in a packet during an Xmas scan?

Accepted Answer

FIN, PSH, URG

Answer

An Xmas scan lights up the FIN, PSH, and URG flags like a Christmas tree.

Certified Ethical Hacker Practice Test