GCIH Scanning and Mapping — Timed 10 Questions

Question 1

An incident responder needs to identify active hosts on a segmented network while minimizing the risk of triggering IDS alerts. Which Nmap technique is most appropriate for a stealthy discovery scan?

Accepted Answer

TCP SYN scan (-sS). TCP SYN scanning, often called half-open scanning, is the standard for stealthy host discovery because it never completes the TCP three-way handshake. By sending a SYN packet and waiting for a SYN/ACK, the scanner determines host status without establishing a full connection, which significantly reduces logged events on many application-layer logging systems and target service logs compared to full TCP connect scans.

Answer

TCP Connect scan (-sT)

Answer

UDP scan (-sU)

Answer

Ping sweep (-sP)

Question 2

When conducting network mapping, which TWO actions are considered best practice for ensuring the scan remains within the defined scope of an incident response engagement?

Accepted Answer

Document the scan parameters, timestamp, and source IP addresses used.. Strict adherence to scope is critical to avoid legal and operational liability. Coordinating scan ranges with network administrators ensures that sensitive assets are not adversely impacted, and maintaining detailed logs of all traffic generated allows for post-incident review and validation that the responder only interacted with authorized subnets, thereby protecting the integrity of the professional engagement and preventing unauthorized disruption of enterprise infrastructure.

Answer

Include the entire internal address space to ensure no assets are missed.

Answer

Automate the scan to run continuously throughout the investigation.

Answer

Use the most aggressive timing template to minimize engagement time.

Question 3

When mapping a network that employs egress filtering, which TWO scanning methodologies will likely produce inaccurate or incomplete results?

Accepted Answer

IP Protocol scans (-sO). Egress filtering limits the traffic leaving a network segment, meaning probes that rely on specific return packet types or source ports might be blocked. When responders use techniques that depend on non-standard responses or that are easily flagged by firewall rules, the lack of return traffic leads to an incomplete network map, effectively blinding the investigator to the true state of the internal environment.

Answer

Full TCP Connect scans

Answer

TCP SYN scans (-sS)

Answer

Service version detection (-sV)

Question 4

An incident handler is performing an authorized network discovery on a segmented enterprise network and needs to identify active hosts without triggering aggressive firewall alarms. Which Nmap scanning technique best achieves stealthy host discovery while minimizing noise?

Accepted Answer

TCP SYN ping scan using the -PS parameter directed at commonly active ports such as port 80 and 443.. TCP SYN ping scans send packets to ports like 80 or 443, effectively bypassing basic egress filtering and stateless packet inspection firewalls without establishing a full three-way handshake. This reduces log clutter and avoids generating application-layer connection events on target systems during initial reconnaissance phases.

Answer

TCP Connect scan using the -sT flag to guarantee complete handshake completion across all targeted destination ports.

Answer

ICMP Echo request ping scan utilizing the -PE parameter to discover live IP addresses across the subnet.

Answer

UDP ping scan using the -PU parameter targeting high-numbered ports to query stateless services.

Question 5

An incident handler is tasked with auditing a corporate network for unauthorized live hosts without triggering aggressive firewall alarms or intrusion detection systems. Which Nmap scanning technique is best suited for discovering active hosts while minimizing the generation of traditional connection-state logs on stateful packet inspection firewalls?

Accepted Answer

TCP ACK scanning using the -sA flag to elicit RST responses from live systems behind filtering boundary devices.. TCP ACK scanning sends packets with only the ACK flag set, which can bypass stateless firewalls and certain rule sets because they assume an established connection exists. While it cannot reliably determine open ports, it effectively maps live hosts by analyzing RST responses generated by hosts when receiving unexpected ACK packets.

Answer

TCP SYN stealth scan using the -sS flag to prevent complete three-way handshakes from forming on target ports.

Answer

UDP packet scanning using the -sU flag to probe high-numbered destination ports across the entire subnet range.

Answer

ICMP Echo request ping sweep using the -sn flag with timing templates set to paranoid levels for evasion.

Question 6

During an internal network vulnerability assessment, an incident handler needs to perform host discovery across a heavily segmented corporate environment where standard ICMP Echo requests are completely blocked by internal host firewalls. Which TWO Nmap discovery techniques should the analyst select to reliably identify live hosts without relying on ICMP Echo? (Choose TWO)

Accepted Answer

TCP SYN Ping (-PS443) targeting common web ports to trigger a SYN-ACK or RST response from active systems.. When ICMP Echo is blocked, analysts must leverage alternative probing techniques that traverse host firewalls. TCP SYN Ping (-PS) sends empty SYN packets to common ports like 80 or 443, which often bypass perimeter controls. UDP Ping (-PU) sends UDP packets to typically closed ports, triggering ICMP Port Unreachable responses that confirm a host is alive. Both methods effectively discover live systems when standard ping fails.

Answer

ICMP Information Request (-PE with alternate timestamp parameters) to bypass standard router filtering blocks.

Answer

ARP Ping (-PR) utilizing local broadcast frames to discover active nodes on the directly connected subnet.

Answer

TCP NULL Ping (-PN) to disable host discovery and force scanning of all specified IP addresses.

Question 7

During an incident response engagement, you must determine which hosts on a /24 subnet are alive without sending any TCP or UDP packets that could be logged by host-based firewalls. Which Nmap scan technique should you use?

Accepted Answer

nmap -PR 192.168.1.0/24. To discover live hosts on a local subnet without sending TCP or UDP packets, an ARP ping scan is the appropriate technique. ARP requests are broadcast at layer 2 and are not filtered by host-based firewalls that operate at higher layers. The -PR flag instructs Nmap to use ARP, making it the correct answer for this scenario.

Answer

nmap -PE 192.168.1.0/24

Answer

nmap -sn 192.168.1.0/24

Answer

nmap -sP 192.168.1.0/24

Question 8

An incident responder is mapping a network protected by a stateful firewall that drops unsolicited TCP packets. The responder needs to identify open TCP ports on a target host. Which two Nmap scan types are most likely to succeed in this environment? (Choose two.)

Accepted Answer

TCP FIN scan (-sF). In a stateful firewall environment, scans that do not initiate a new connection are more likely to pass through. TCP ACK and FIN scans use packets that are not SYN, so the firewall may allow them if it does not track them as new connections. These scans can help identify open ports or map firewall rules, making them the best choices among the options.

Answer

TCP SYN scan (-sS)

Answer

TCP window scan (-sW)

Answer

TCP connect scan (-sT)

Question 9

You are conducting an authorized vulnerability assessment on a web server farm. The firewall between your scanner and the targets drops all TCP packets with the SYN flag set to ports other than 80 and 443, but it allows TCP packets with the ACK flag set to any port. You need to determine which ports are open on the target hosts. Which Nmap scan type is most likely to yield useful results in this environment?

Accepted Answer

TCP ACK scan (-sA). The TCP ACK scan is designed to map firewall rulesets by sending ACK packets. Because the firewall permits ACK packets to any port, the scan can elicit RST responses from both open and closed ports, while filtered ports remain silent. This allows you to determine which ports are filtered, which is valuable when SYN-based scans are blocked. It cannot identify open ports directly, but it reveals the firewall's filtering behaviour, which is the key information in this scenario.

Answer

TCP FIN scan (-sF)

Answer

TCP Xmas scan (-sX)

Answer

TCP connect scan (-sT)

Question 10

An incident handler is mapping a large, routed enterprise network and needs to identify live hosts efficiently while minimizing the scan's impact on network performance. The network has multiple subnets and some hosts block ICMP echo requests. Which two Nmap techniques should be used together to achieve accurate host discovery with reduced scan time? (Choose two.)

Accepted Answer

Use -sn with the default host discovery probes. Combining -sn with -PS80,443 leverages Nmap's default multi-probe discovery and adds TCP SYN probes to common web ports. This approach detects hosts that block ICMP and avoids port scanning, keeping network impact low and scan time short. The other options either rely solely on ICMP, perform a full SYN scan, or use an aggressive timing template, none of which meet the dual goals of accuracy and efficiency.

Answer

Use -PE to send only ICMP echo requests

Answer

Use -sS to perform a SYN scan on all ports

Answer

Use -T5 to set the timing template to insane