GCIH Scanning and Mapping — 20 Questions

Question 1

An incident responder needs to identify active hosts on a segmented network while minimizing the risk of triggering IDS alerts. Which Nmap technique is most appropriate for a stealthy discovery scan?

Accepted Answer

TCP SYN scan (-sS). TCP SYN scanning, often called half-open scanning, is the standard for stealthy host discovery because it never completes the TCP three-way handshake. By sending a SYN packet and waiting for a SYN/ACK, the scanner determines host status without establishing a full connection, which significantly reduces logged events on many application-layer logging systems and target service logs compared to full TCP connect scans.

Answer

TCP Connect scan (-sT)

Answer

UDP scan (-sU)

Answer

Ping sweep (-sP)

Question 2

When conducting network mapping, which TWO actions are considered best practice for ensuring the scan remains within the defined scope of an incident response engagement?

Accepted Answer

Document the scan parameters, timestamp, and source IP addresses used.. Strict adherence to scope is critical to avoid legal and operational liability. Coordinating scan ranges with network administrators ensures that sensitive assets are not adversely impacted, and maintaining detailed logs of all traffic generated allows for post-incident review and validation that the responder only interacted with authorized subnets, thereby protecting the integrity of the professional engagement and preventing unauthorized disruption of enterprise infrastructure.

Answer

Include the entire internal address space to ensure no assets are missed.

Answer

Automate the scan to run continuously throughout the investigation.

Answer

Use the most aggressive timing template to minimize engagement time.

Question 3

When mapping a network that employs egress filtering, which TWO scanning methodologies will likely produce inaccurate or incomplete results?

Accepted Answer

IP Protocol scans (-sO). Egress filtering limits the traffic leaving a network segment, meaning probes that rely on specific return packet types or source ports might be blocked. When responders use techniques that depend on non-standard responses or that are easily flagged by firewall rules, the lack of return traffic leads to an incomplete network map, effectively blinding the investigator to the true state of the internal environment.

Answer

Full TCP Connect scans

Answer

TCP SYN scans (-sS)

Answer

Service version detection (-sV)

Question 4

An incident handler is performing an authorized network discovery on a segmented enterprise network and needs to identify active hosts without triggering aggressive firewall alarms. Which Nmap scanning technique best achieves stealthy host discovery while minimizing noise?

Accepted Answer

TCP SYN ping scan using the -PS parameter directed at commonly active ports such as port 80 and 443.. TCP SYN ping scans send packets to ports like 80 or 443, effectively bypassing basic egress filtering and stateless packet inspection firewalls without establishing a full three-way handshake. This reduces log clutter and avoids generating application-layer connection events on target systems during initial reconnaissance phases.

Answer

TCP Connect scan using the -sT flag to guarantee complete handshake completion across all targeted destination ports.

Answer

ICMP Echo request ping scan utilizing the -PE parameter to discover live IP addresses across the subnet.

Answer

UDP ping scan using the -PU parameter targeting high-numbered ports to query stateless services.

Question 5

An incident handler is tasked with auditing a corporate network for unauthorized live hosts without triggering aggressive firewall alarms or intrusion detection systems. Which Nmap scanning technique is best suited for discovering active hosts while minimizing the generation of traditional connection-state logs on stateful packet inspection firewalls?

Accepted Answer

TCP ACK scanning using the -sA flag to elicit RST responses from live systems behind filtering boundary devices.. TCP ACK scanning sends packets with only the ACK flag set, which can bypass stateless firewalls and certain rule sets because they assume an established connection exists. While it cannot reliably determine open ports, it effectively maps live hosts by analyzing RST responses generated by hosts when receiving unexpected ACK packets.

Answer

TCP SYN stealth scan using the -sS flag to prevent complete three-way handshakes from forming on target ports.

Answer

UDP packet scanning using the -sU flag to probe high-numbered destination ports across the entire subnet range.

Answer

ICMP Echo request ping sweep using the -sn flag with timing templates set to paranoid levels for evasion.

Question 6

During an internal network vulnerability assessment, an incident handler needs to perform host discovery across a heavily segmented corporate environment where standard ICMP Echo requests are completely blocked by internal host firewalls. Which TWO Nmap discovery techniques should the analyst select to reliably identify live hosts without relying on ICMP Echo? (Choose TWO)

Accepted Answer

TCP SYN Ping (-PS443) targeting common web ports to trigger a SYN-ACK or RST response from active systems.. When ICMP Echo is blocked, analysts must leverage alternative probing techniques that traverse host firewalls. TCP SYN Ping (-PS) sends empty SYN packets to common ports like 80 or 443, which often bypass perimeter controls. UDP Ping (-PU) sends UDP packets to typically closed ports, triggering ICMP Port Unreachable responses that confirm a host is alive. Both methods effectively discover live systems when standard ping fails.

Answer

ICMP Information Request (-PE with alternate timestamp parameters) to bypass standard router filtering blocks.

Answer

ARP Ping (-PR) utilizing local broadcast frames to discover active nodes on the directly connected subnet.

Answer

TCP NULL Ping (-PN) to disable host discovery and force scanning of all specified IP addresses.

Question 7

During an incident response engagement, you must determine which hosts on a /24 subnet are alive without sending any TCP or UDP packets that could be logged by host-based firewalls. Which Nmap scan technique should you use?

Accepted Answer

nmap -PR 192.168.1.0/24. To discover live hosts on a local subnet without sending TCP or UDP packets, an ARP ping scan is the appropriate technique. ARP requests are broadcast at layer 2 and are not filtered by host-based firewalls that operate at higher layers. The -PR flag instructs Nmap to use ARP, making it the correct answer for this scenario.

Answer

nmap -PE 192.168.1.0/24

Answer

nmap -sn 192.168.1.0/24

Answer

nmap -sP 192.168.1.0/24

Question 8

An incident responder is mapping a network protected by a stateful firewall that drops unsolicited TCP packets. The responder needs to identify open TCP ports on a target host. Which two Nmap scan types are most likely to succeed in this environment? (Choose two.)

Accepted Answer

TCP FIN scan (-sF). In a stateful firewall environment, scans that do not initiate a new connection are more likely to pass through. TCP ACK and FIN scans use packets that are not SYN, so the firewall may allow them if it does not track them as new connections. These scans can help identify open ports or map firewall rules, making them the best choices among the options.

Answer

TCP SYN scan (-sS)

Answer

TCP window scan (-sW)

Answer

TCP connect scan (-sT)

Question 9

You are conducting an authorized vulnerability assessment on a web server farm. The firewall between your scanner and the targets drops all TCP packets with the SYN flag set to ports other than 80 and 443, but it allows TCP packets with the ACK flag set to any port. You need to determine which ports are open on the target hosts. Which Nmap scan type is most likely to yield useful results in this environment?

Accepted Answer

TCP ACK scan (-sA). The TCP ACK scan is designed to map firewall rulesets by sending ACK packets. Because the firewall permits ACK packets to any port, the scan can elicit RST responses from both open and closed ports, while filtered ports remain silent. This allows you to determine which ports are filtered, which is valuable when SYN-based scans are blocked. It cannot identify open ports directly, but it reveals the firewall's filtering behaviour, which is the key information in this scenario.

Answer

TCP FIN scan (-sF)

Answer

TCP Xmas scan (-sX)

Answer

TCP connect scan (-sT)

Question 10

An incident handler is mapping a large, routed enterprise network and needs to identify live hosts efficiently while minimizing the scan's impact on network performance. The network has multiple subnets and some hosts block ICMP echo requests. Which two Nmap techniques should be used together to achieve accurate host discovery with reduced scan time? (Choose two.)

Accepted Answer

Use -sn with the default host discovery probes. Combining -sn with -PS80,443 leverages Nmap's default multi-probe discovery and adds TCP SYN probes to common web ports. This approach detects hosts that block ICMP and avoids port scanning, keeping network impact low and scan time short. The other options either rely solely on ICMP, perform a full SYN scan, or use an aggressive timing template, none of which meet the dual goals of accuracy and efficiency.

Answer

Use -PE to send only ICMP echo requests

Answer

Use -sS to perform a SYN scan on all ports

Answer

Use -T5 to set the timing template to insane

Question 11

Which Nmap flag is essential when you need to perform OS fingerprinting to determine the target operating system version during an incident response assessment?

Accepted Answer

-O. The -O flag instructs Nmap to perform TCP/IP stack fingerprinting, which analyzes specific behaviors of the target's networking stack. This is vital for responders to classify assets, identify potential legacy systems, and determine if the target matches known vulnerable OS versions during the scoping phase of an incident investigation or routine security audit.

Answer

-sV

Answer

-A

Answer

-sS

Question 12

A responder is performing a vulnerability scan on a segment containing industrial control systems. Which Nmap timing template should be used to avoid disrupting sensitive, potentially fragile hardware?

Accepted Answer

T0. Industrial control systems (ICS) and legacy devices are often highly sensitive to high-traffic volumes. Using T0 (paranoid) or T1 (sneaky) ensures that packets are sent at a slow rate, giving these devices sufficient time to process requests. This minimizes the risk of a buffer overflow or service crash that could result from overwhelming the device's limited computational resources with modern scanning speeds.

Answer

T3

Answer

T4

Answer

T5

Question 13

Which tool is best suited for identifying potentially misconfigured SMB services that could be leveraged for lateral movement within a compromised Windows environment?

Accepted Answer

Nmap with NSE scripts. Nmap's scripting engine (NSE) provides dedicated scripts like 'smb-vuln*' that can scan for specific vulnerabilities such as MS17-010. By integrating these scripts directly into the scanning workflow, responders can quickly map the attack surface and identify high-value targets for lateral movement without switching tools, ensuring a cohesive and efficient assessment of the environment's configuration security.

Answer

Wireshark

Answer

Netcat

Answer

Tcpdump

Question 14

Why is it important to randomize the target IP addresses when performing a large-scale network scan?

Accepted Answer

To avoid triggering threshold-based IDS alerts on specific subnets.. Randomizing scan targets is a defensive measure against triggering automated threshold-based IDS/IPS alerts. By jumping between different subnets, the scanner avoids concentrating traffic on a single point in the network, which effectively prevents the security system from correlating multiple hits on a single host or subnet, thereby keeping the responder's reconnaissance activity below the typical detection thresholds of the organization.

Answer

To reduce the scan duration by optimizing packet routing.

Answer

To bypass the target operating system's rate limiting.

Answer

To ensure the scanner utilizes all available network interfaces.

Question 15

Which Nmap scan type should be used when the goal is to map the topology of a network and identify active hosts without establishing any TCP or UDP connections?

Accepted Answer

ICMP Echo Request (-sn). ICMP-based discovery, such as a ping sweep, identifies hosts by simply checking for responses to 'echo requests'. Because this avoids the transport layer (TCP/UDP) entirely, it is a low-impact and highly efficient way to map network topology. This is vital when the responder must map a large environment quickly without generating connection-based logs on the target systems or intermediary security devices.

Answer

TCP SYN scan (-sS)

Answer

TCP Connect scan (-sT)

Answer

UDP scan (-sU)

Question 16

A responder needs to map an internal network but cannot use standard tools due to strict endpoint protection. Which technique can be used with native command-line tools to perform a basic port check on a remote host?

Accepted Answer

Using a PowerShell Test-NetConnection command.. Using native tools like PowerShell or Netcat allows for basic network verification when dedicated scanning tools are blocked by endpoint security suites. By leveraging built-in functionality such as Test-NetConnection in PowerShell, a responder can verify reachability and port status without introducing unauthorized binaries, thereby maintaining the integrity of the environment while still performing necessary incident response data gathering.

Answer

Running an nmap.exe binary from a USB drive.

Answer

Initiating a telnet session to every port.

Answer

Pinging the broadcast address of the subnet.

Question 17

Which Nmap scan flag allows a responder to bypass simple packet filters by using specific source ports, such as port 53, to appear as legitimate DNS traffic?

Accepted Answer

--source-port 53. The --source-port flag allows for the manipulation of the packet's source port, which is a common technique for bypassing firewall rules configured to permit traffic from trusted services like DNS. This is useful for responders trying to map networks where basic ingress/egress filtering is in place, as it mimics expected protocol behavior to slip through simple security controls.

Answer

--spoof-mac

Answer

-f

Answer

--data-length

Question 18

Which Nmap argument should be used to display the reason why a port is reported as 'open', 'closed', or 'filtered' in the scan results?

Accepted Answer

--reason. The --reason flag provides deep visibility into why Nmap labeled a port in a specific way by reporting the exact packet or ICMP message that caused the determination. This is incredibly useful for incident responders, as it allows them to identify exactly which network devices (like a firewall or a specific host OS behavior) are causing traffic to be filtered or dropped during an assessment.

Answer

--verbose

Answer

--packet-trace

Answer

-d

Question 19

What is the primary risk associated with using 'aggressive' scan timing templates (like T4 or T5) in an environment with high network latency?

Accepted Answer

The scan will yield inaccurate results due to premature timeouts.. Aggressive timing templates rely on short timeouts, expecting quick responses from targets. In high-latency networks, these short timeouts lead to false negatives, where Nmap incorrectly labels a port as 'filtered' simply because the response did not arrive before the aggressive timer expired. This leads to inaccurate mapping and missed vulnerabilities, directly undermining the goals of the incident investigation.

Answer

The scan will consume excessive bandwidth.

Answer

The scan will trigger an automated shutdown of the network.

Answer

The scan will crash the Nmap engine.

Question 20

An incident handler is performing an authorized network discovery scan on a perimeter segment. To bypass simple static stateful inspection firewalls that drop unexpected TCP SYN packets, the analyst decides to utilize an ACK scan (-sA in Nmap). What is the primary limitation of utilizing this specific scan type during network mapping?

Accepted Answer

It cannot distinguish between open and closed ports because both respond with a TCP RST packet.. An ACK scan sends packets with only the ACK flag set, which bypasses stateless or simple stateful firewalls that only track initial connection attempts. However, because an ACK packet is sent to an established connection, any port that is open or closed will reply with a RST packet. This behavior prevents the analyst from distinguishing between open and closed ports, making it useful solely for determining if a port is filtered by a firewall.

Answer

It requires root privileges on the scanning host to construct raw TCP frames with custom header flags.

Answer

It causes immediate system instability and kernel panics on legacy Microsoft Windows operating systems due to malformed TCP stacks.

Answer

It triggers immediate critical high-severity alerts on all intrusion detection systems due to the distinct lack of a three-way handshake initiation.