GPEN Scanning and Host Discovery — 15 Questions

Question 1

You are tasked with identifying live hosts on a network protected by an aggressive IDS. Which TWO of the following Nmap techniques are considered the most effective for evading detection while performing host discovery?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the -T0 timing template.. Slow timing templates and packet fragmentation are key for evasion. Timing templates allow the scanner to blend in with normal traffic patterns, while fragmentation breaks packets into smaller pieces to confuse older IDS signatures. Mastering these techniques allows a tester to operate under the radar, ensuring that discovery remains successful even in environments where security administrators have configured high-sensitivity detection thresholds to catch automated scanning tools.

Answer

Increase the packet rate using --max-rate 5000.

Answer

Use the -T5 (insane) timing template for speed.

Answer

Scan all 65,535 ports on every host.

Question 2

When conducting a port scan on a target that sits behind a stateless firewall, you notice that all TCP ports return a status of 'filtered'. Which Nmap command-line argument should you use to determine if these ports are actually open but the firewall is just dropping the packets?

Accepted Answer

-sV (Service Version Detection). A stateless firewall often drops packets without sending an RST response, leading Nmap to report 'filtered'. By using the --script command with specialized Nmap scripts or modifying the packet TTL, you can sometimes trigger responses that bypass the stateless filter. This is important for testers to identify hidden services that firewalls may be unintentionally masking, ensuring that no potential attack surface is overlooked during the reconnaissance phase of the engagement.

Answer

-sS (SYN Scan)

Answer

-Pn (Treat all hosts as online)

Answer

-sO (IP Protocol Scan)

Question 3

You are performing a penetration test and need to discover hosts on a network segment where you suspect the firewall is configured to block all incoming traffic from your source IP address. Which technique would be the most effective way to identify live hosts in this scenario?

Accepted Answer

Utilize decoy scanning to mask the source IP.. Using a decoy source IP address or spoofing allows a tester to appear as if traffic is originating from a different source, potentially bypassing simple ACL-based blocks. This is a fundamental technique for assessing how perimeter devices handle traffic from different segments. It is a critical skill for testers who need to verify if host discovery is being hindered by specific blacklists or overly restrictive network access controls.

Answer

Perform a simple ICMP sweep with no spoofing.

Answer

Use the --source-port option to mimic DNS traffic.

Answer

Increase the scan speed to T5 to overwhelm the firewall.

Question 4

You have identified an open port on a target, but the service version detection is returning 'unknown'. Which Nmap option should you use to gain more granular information about the specific service running on that port?

Accepted Answer

--version-intensity 9. When version detection is insufficient, increasing the intensity of the probe with --version-intensity is the standard approach. This forces Nmap to try more probes from the nmap-service-probes file. This is crucial for testers when standard discovery fails, as identifying the exact service and version is often the key to finding a matching exploit or security vulnerability in the later stages of the assessment.

Answer

--version-all

Answer

-A (Aggressive scan mode)

Answer

-sS (SYN Scan)

Question 5

Which THREE of the following are valid reasons to perform a service version scan (-sV) during a penetration test?

Accepted Answer

To identify vulnerabilities associated with specific software versions.. Service version scanning is essential for identifying potential exploits, mapping the attack surface, and gathering intelligence about the target environment. By identifying specific software and version numbers, a tester can cross-reference them with known vulnerabilities. This process transforms a simple list of open ports into a prioritized list of targets, which is the core objective of the reconnaissance and vulnerability assessment phase of any professional security engagement.

Answer

To bypass IDS/IPS signatures by altering the service response.

Answer

To increase the scan speed for large network subnets.

Question 6

You are performing a network discovery scan and want to identify which operating systems are running on your targets. Which TWO Nmap flags or combinations are most appropriate for this task?

Accepted Answer

-O (Enable OS detection). OS fingerprinting is a critical step in reconnaissance. Using -O is the native flag for OS detection, but it often needs to be paired with other techniques to ensure accuracy. Understanding how to use these flags correctly is essential for testers who need to tailor their exploitation attempts to specific target platforms, ensuring that the chosen payloads match the underlying architecture and service configurations discovered.

Answer

-sV (Service Version Detection)

Answer

-sP (Ping scan)

Answer

--script=banner

Question 7

During a scan, you receive a 'filtered' status on most ports. You want to determine if this is because of a network-based IPS or a host-based firewall. Which Nmap technique would best assist in differentiating between these two possibilities?

Accepted Answer

-sA (ACK Scan). The TCP ACK scan (-sA) is specifically designed to map firewall rule sets. By sending ACK packets, you can determine if a port is 'unfiltered' (meaning it can be reached) or 'filtered' (meaning a device is dropping packets). This is a vital skill for testers to determine if the filtering is occurring at the network perimeter or the host, which changes the strategy for potential bypass techniques.

Answer

-sS (SYN Scan)

Answer

-sU (UDP Scan)

Answer

-sN (Null Scan)

Question 8

During an internal penetration test, you discover that the target network uses a stateful firewall that blocks TCP SYN packets to most ports but permits TCP ACK packets to any port. You need to enumerate live hosts and open ports while avoiding detection. Which Nmap scan technique should you use to bypass the firewall's filtering and identify accessible services?

Accepted Answer

TCP ACK scan (-sA). A TCP ACK scan is specifically designed to map firewall rulesets and determine which ports are filtered versus unfiltered. In this scenario, the stateful firewall blocks SYN packets but allows ACK packets, making the ACK scan effective for discovering accessible hosts and ports. It does not provide service version information but is ideal for bypassing the filtering and identifying reachable services.

Answer

TCP Maimon scan (-sM)

Answer

TCP FIN scan (-sF)

Answer

TCP Xmas scan (-sX)

Question 9

You are performing a penetration test and need to discover live hosts on a subnet. The client has requested that you minimize network traffic and avoid triggering intrusion detection systems. Which Nmap host discovery technique is most appropriate?

Accepted Answer

TCP SYN ping scan (-PS). A TCP SYN ping scan is an effective host discovery method that sends SYN packets to common TCP ports. It is stealthy because it resembles normal traffic and often bypasses firewalls that block ICMP. It generates minimal traffic, making it suitable for environments where minimizing network noise and avoiding IDS triggers are priorities. This technique balances reliability and stealth, making it the best choice among the options.

Answer

UDP ping scan (-PU)

Answer

ARP ping scan (-PR)

Answer

ICMP echo request scan (-PE)

Question 10

You are conducting an external penetration test and want to discover live hosts on a target network without performing a full port scan. Which two Nmap options are valid host discovery techniques that can be used with -sn? (Choose two.)

Accepted Answer

-PS. Both -PE and -PS are legitimate host discovery probes that work with -sn. ICMP echo requests are the traditional method, while TCP SYN pings to common ports provide a fallback when ICMP is filtered. The other options are enumeration features that require port scanning and are incompatible with -sn.

Answer

-A

Answer

-O

Answer

-sV

Question 11

You are conducting a penetration test and need to scan a target host that is protected by a firewall that drops all TCP packets with the SYN flag set, but allows TCP packets with the FIN flag set. You want to identify open TCP ports on the target. Which Nmap scan type should you use to bypass this firewall rule?

Accepted Answer

TCP FIN scan (-sF). The TCP FIN scan uses packets with only the FIN flag, which the firewall permits. By sending FIN packets, you can probe ports without triggering the SYN-blocking rule. Open ports ignore the packet, while closed ports respond with RST, allowing you to map open ports. This makes it the appropriate scan type for this firewall configuration.

Answer

TCP NULL scan (-sN)

Answer

TCP Xmas scan (-sX)

Answer

TCP SYN scan (-sS)

Question 12

You are performing a penetration test against a target that has a firewall configured to drop all incoming TCP packets with the SYN flag set. You need to determine if a specific TCP port is open. Which Nmap scan type is most likely to succeed in this scenario?

Accepted Answer

TCP FIN scan (-sF). The TCP FIN scan sends packets without the SYN flag, so it can bypass a firewall that drops SYN packets. It can determine if a port is closed (RST response) or open|filtered (no response). The other scans either use SYN packets (blocked) or do not determine port openness.

Answer

TCP ACK scan (-sA)

Answer

TCP SYN scan (-sS)

Answer

TCP connect scan (-sT)

Question 13

You are performing a network audit and need to identify live hosts across a segmented network while minimizing the risk of triggering IDS alerts. Which Nmap technique is most appropriate for stealthy host discovery in a subnet where ICMP echo requests are filtered by the firewall?

Accepted Answer

Utilize TCP SYN ping (-PS) on common service ports.. Nmap's TCP SYN ping (-PS) is highly effective because it sends a small SYN packet to specified ports, like 80 or 443, which are typically open or acknowledged by firewalls. This bypasses ICMP filters while mimicking legitimate traffic. Understanding how to circumvent basic perimeter defenses is critical for penetration testers to ensure comprehensive discovery without alerting security systems that monitor for common ICMP-based scanning patterns or heavy traffic floods.

Answer

Perform a standard ICMP echo sweep (-PE).

Answer

Execute a full TCP connect scan on all ports (-sT).

Answer

Run an ARP scan across the entire subnet (-PR).

Question 14

Refer to the exhibit. You executed an Nmap scan against a host and received the output shown. Which scanning technique was most likely used to produce this specific state-based output while avoiding the completion of a full TCP three-way handshake?

Accepted Answer

TCP SYN Scan (-sS). The output indicates open ports without explicitly showing a full connection. Nmap's SYN scan (-sS) is the default and most popular method for this result. It initiates the handshake but sends an RST packet immediately after receiving the SYN/ACK, preventing a full connection. This technique is essential for testers to map services quickly while remaining stealthier than a full connection-based scan which would be logged by most application-layer firewalls.

Answer

TCP Connect Scan (-sT)

Answer

UDP Scan (-sU)

Answer

TCP ACK Scan (-sA)

Question 15

You are analyzing a target environment and need to identify UDP services. Which THREE of the following are significant challenges associated with performing an accurate UDP scan compared to a TCP scan?

Accepted Answer

UDP is connectionless, requiring Nmap to wait for a response that may never come.. UDP is a connectionless protocol, which creates inherent difficulties in scanning. Because there is no handshake, responses are inconsistent, leading to unreliable results. Testers must be aware that UDP scanning is often significantly slower and prone to false negatives due to rate-limiting by target hosts. Understanding these limitations is critical for reporting accurate service maps and knowing when to re-scan or verify results using alternative methods.

Answer

UDP ports must be scanned sequentially, preventing parallelization.

Answer

UDP packets are always blocked by stateful firewalls regardless of status.