GPEN Scanning and Host Discovery — 10 Questions

Question 1

You are tasked with identifying live hosts on a network protected by an aggressive IDS. Which TWO of the following Nmap techniques are considered the most effective for evading detection while performing host discovery?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the -T0 timing template.. Slow timing templates and packet fragmentation are key for evasion. Timing templates allow the scanner to blend in with normal traffic patterns, while fragmentation breaks packets into smaller pieces to confuse older IDS signatures. Mastering these techniques allows a tester to operate under the radar, ensuring that discovery remains successful even in environments where security administrators have configured high-sensitivity detection thresholds to catch automated scanning tools.

Answer

Increase the packet rate using --max-rate 5000.

Answer

Use the -T5 (insane) timing template for speed.

Answer

Scan all 65,535 ports on every host.

Question 2

When conducting a port scan on a target that sits behind a stateless firewall, you notice that all TCP ports return a status of 'filtered'. Which Nmap command-line argument should you use to determine if these ports are actually open but the firewall is just dropping the packets?

Accepted Answer

-sV (Service Version Detection). A stateless firewall often drops packets without sending an RST response, leading Nmap to report 'filtered'. By using the --script command with specialized Nmap scripts or modifying the packet TTL, you can sometimes trigger responses that bypass the stateless filter. This is important for testers to identify hidden services that firewalls may be unintentionally masking, ensuring that no potential attack surface is overlooked during the reconnaissance phase of the engagement.

Answer

-sS (SYN Scan)

Answer

-Pn (Treat all hosts as online)

Answer

-sO (IP Protocol Scan)

Question 3

You are performing a penetration test and need to discover hosts on a network segment where you suspect the firewall is configured to block all incoming traffic from your source IP address. Which technique would be the most effective way to identify live hosts in this scenario?

Accepted Answer

Utilize decoy scanning to mask the source IP.. Using a decoy source IP address or spoofing allows a tester to appear as if traffic is originating from a different source, potentially bypassing simple ACL-based blocks. This is a fundamental technique for assessing how perimeter devices handle traffic from different segments. It is a critical skill for testers who need to verify if host discovery is being hindered by specific blacklists or overly restrictive network access controls.

Answer

Perform a simple ICMP sweep with no spoofing.

Answer

Use the --source-port option to mimic DNS traffic.

Answer

Increase the scan speed to T5 to overwhelm the firewall.

Question 4

You have identified an open port on a target, but the service version detection is returning 'unknown'. Which Nmap option should you use to gain more granular information about the specific service running on that port?

Accepted Answer

--version-intensity 9. When version detection is insufficient, increasing the intensity of the probe with --version-intensity is the standard approach. This forces Nmap to try more probes from the nmap-service-probes file. This is crucial for testers when standard discovery fails, as identifying the exact service and version is often the key to finding a matching exploit or security vulnerability in the later stages of the assessment.

Answer

--version-all

Answer

-A (Aggressive scan mode)

Answer

-sS (SYN Scan)

Question 5

Which THREE of the following are valid reasons to perform a service version scan (-sV) during a penetration test?

Accepted Answer

To identify vulnerabilities associated with specific software versions.. Service version scanning is essential for identifying potential exploits, mapping the attack surface, and gathering intelligence about the target environment. By identifying specific software and version numbers, a tester can cross-reference them with known vulnerabilities. This process transforms a simple list of open ports into a prioritized list of targets, which is the core objective of the reconnaissance and vulnerability assessment phase of any professional security engagement.

Answer

To bypass IDS/IPS signatures by altering the service response.

Answer

To increase the scan speed for large network subnets.

Question 6

You are performing a network discovery scan and want to identify which operating systems are running on your targets. Which TWO Nmap flags or combinations are most appropriate for this task?

Accepted Answer

-O (Enable OS detection). OS fingerprinting is a critical step in reconnaissance. Using -O is the native flag for OS detection, but it often needs to be paired with other techniques to ensure accuracy. Understanding how to use these flags correctly is essential for testers who need to tailor their exploitation attempts to specific target platforms, ensuring that the chosen payloads match the underlying architecture and service configurations discovered.

Answer

-sV (Service Version Detection)

Answer

-sP (Ping scan)

Answer

--script=banner

Question 7

During a scan, you receive a 'filtered' status on most ports. You want to determine if this is because of a network-based IPS or a host-based firewall. Which Nmap technique would best assist in differentiating between these two possibilities?

Accepted Answer

-sA (ACK Scan). The TCP ACK scan (-sA) is specifically designed to map firewall rule sets. By sending ACK packets, you can determine if a port is 'unfiltered' (meaning it can be reached) or 'filtered' (meaning a device is dropping packets). This is a vital skill for testers to determine if the filtering is occurring at the network perimeter or the host, which changes the strategy for potential bypass techniques.

Answer

-sS (SYN Scan)

Answer

-sU (UDP Scan)

Answer

-sN (Null Scan)

Question 8

During an internal penetration test, you discover that the target network uses a stateful firewall that blocks TCP SYN packets to most ports but permits TCP ACK packets to any port. You need to enumerate live hosts and open ports while avoiding detection. Which Nmap scan technique should you use to bypass the firewall's filtering and identify accessible services?

Accepted Answer

TCP ACK scan (-sA). A TCP ACK scan is specifically designed to map firewall rulesets and determine which ports are filtered versus unfiltered. In this scenario, the stateful firewall blocks SYN packets but allows ACK packets, making the ACK scan effective for discovering accessible hosts and ports. It does not provide service version information but is ideal for bypassing the filtering and identifying reachable services.

Answer

TCP Maimon scan (-sM)

Answer

TCP FIN scan (-sF)

Answer

TCP Xmas scan (-sX)

Question 9

You are performing a penetration test and need to discover live hosts on a subnet. The client has requested that you minimize network traffic and avoid triggering intrusion detection systems. Which Nmap host discovery technique is most appropriate?

Accepted Answer

TCP SYN ping scan (-PS). A TCP SYN ping scan is an effective host discovery method that sends SYN packets to common TCP ports. It is stealthy because it resembles normal traffic and often bypasses firewalls that block ICMP. It generates minimal traffic, making it suitable for environments where minimizing network noise and avoiding IDS triggers are priorities. This technique balances reliability and stealth, making it the best choice among the options.

Answer

UDP ping scan (-PU)

Answer

ARP ping scan (-PR)

Answer

ICMP echo request scan (-PE)

Question 10

You are conducting an external penetration test and want to discover live hosts on a target network without performing a full port scan. Which two Nmap options are valid host discovery techniques that can be used with -sn? (Choose two.)

Accepted Answer

-PS. Both -PE and -PS are legitimate host discovery probes that work with -sn. ICMP echo requests are the traditional method, while TCP SYN pings to common ports provide a fallback when ICMP is filtered. The other options are enumeration features that require port scanning and are incompatible with -sn.

Answer

-A

Answer

-O

Answer

-sV