- Email support@dumps4free.com
Topic 3, Scanning
While doing fast scan using –F option, which file is used to list the range of ports to
scan by nmap?
A.
services
B.
nmap-services
C.
protocols
D.
ports
nmap-services
Explanation: Nmap uses the nmap-services file to provide additional port detail for almost
every scanning method. Every time a port is referenced, it's compared to an available
description in this support file. If the nmap-services file isn't available, nmap reverts to the
/etc/services file applicable for the current operating system.
Which of the following ICMP message types are used for destinations unreachables?
A.
0
B.
3
C.
11
D.
13
E.
17
3
Explanation: Type 3 messages are used for unreachable messages. 0 is Echo Reply, 8 is
Echo request, 11 is time exceeded, 13 is timestamp and 17 is subnet mask request.
Learning these would be advisable for the test.
What port scanning method involves sending spoofed packets to a target system
and then looking for adjustments to the IPID on a zombie system?
A.
Blind Port Scanning
B.
Idle Scanning
C.
Bounce Scanning
D.
Stealth Scanning
E.
UDP Scanning
Idle Scanning
Explanation:
from NMAP:-sI <zombie host[:probeport]> Idlescan: This advanced scan method allows
fora truly blind TCP port scan of the target (meaning no packets are sent tothe tar- get from
your real IP address). Instead, a unique side-channelattack exploits predictable "IP
fragmentation ID" sequence generation onthe zombie host to glean information about the
open ports on the target.
What does a type 3 code 13 represent?(Choose two.
A.
Echo request
B.
Destination unreachable
C.
Network unreachable
D.
Administratively prohibited
E.
Port unreachable
F.
Time exceeded
Destination unreachable
Administratively prohibited
Explanation: Type 3 code 13 is destination unreachable administratively prohibited. This
type of message is typically returned from a device blocking a port.
You are manually conducting Idle Scanning using Hping2. During your scanning you
notice that almost every query increments the IPID regardless of the port being
queried. One or two of the queries cause the IPID to increment by more than one
value. Why do you think this occurs?
A.
The zombie you are using is not truly idle.
B.
A stateful inspection firewall is resetting your queries.
C.
Hping2 cannot be used for idle scanning.
D.
These ports are actually open on the target system.
The zombie you are using is not truly idle.
Explanation: If the IPID is incremented by more than the normal increment for this type of
system it means that the system is interacting with some other system beside yours and
has sent packets to an unknown host between the packets destined for you.
| Page 9 out of 153 Pages |
| Previous |