GPEN Scanning and Host Discovery — 25 Questions

Question 1

You are tasked with identifying live hosts on a network protected by an aggressive IDS. Which TWO of the following Nmap techniques are considered the most effective for evading detection while performing host discovery?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the -T0 timing template.. Slow timing templates and packet fragmentation are key for evasion. Timing templates allow the scanner to blend in with normal traffic patterns, while fragmentation breaks packets into smaller pieces to confuse older IDS signatures. Mastering these techniques allows a tester to operate under the radar, ensuring that discovery remains successful even in environments where security administrators have configured high-sensitivity detection thresholds to catch automated scanning tools.

Answer

Increase the packet rate using --max-rate 5000.

Answer

Use the -T5 (insane) timing template for speed.

Answer

Scan all 65,535 ports on every host.

Question 2

When conducting a port scan on a target that sits behind a stateless firewall, you notice that all TCP ports return a status of 'filtered'. Which Nmap command-line argument should you use to determine if these ports are actually open but the firewall is just dropping the packets?

Accepted Answer

-sV (Service Version Detection). A stateless firewall often drops packets without sending an RST response, leading Nmap to report 'filtered'. By using the --script command with specialized Nmap scripts or modifying the packet TTL, you can sometimes trigger responses that bypass the stateless filter. This is important for testers to identify hidden services that firewalls may be unintentionally masking, ensuring that no potential attack surface is overlooked during the reconnaissance phase of the engagement.

Answer

-sS (SYN Scan)

Answer

-Pn (Treat all hosts as online)

Answer

-sO (IP Protocol Scan)

Question 3

You are performing a penetration test and need to discover hosts on a network segment where you suspect the firewall is configured to block all incoming traffic from your source IP address. Which technique would be the most effective way to identify live hosts in this scenario?

Accepted Answer

Utilize decoy scanning to mask the source IP.. Using a decoy source IP address or spoofing allows a tester to appear as if traffic is originating from a different source, potentially bypassing simple ACL-based blocks. This is a fundamental technique for assessing how perimeter devices handle traffic from different segments. It is a critical skill for testers who need to verify if host discovery is being hindered by specific blacklists or overly restrictive network access controls.

Answer

Perform a simple ICMP sweep with no spoofing.

Answer

Use the --source-port option to mimic DNS traffic.

Answer

Increase the scan speed to T5 to overwhelm the firewall.

Question 4

You have identified an open port on a target, but the service version detection is returning 'unknown'. Which Nmap option should you use to gain more granular information about the specific service running on that port?

Accepted Answer

--version-intensity 9. When version detection is insufficient, increasing the intensity of the probe with --version-intensity is the standard approach. This forces Nmap to try more probes from the nmap-service-probes file. This is crucial for testers when standard discovery fails, as identifying the exact service and version is often the key to finding a matching exploit or security vulnerability in the later stages of the assessment.

Answer

--version-all

Answer

-A (Aggressive scan mode)

Answer

-sS (SYN Scan)

Question 5

Which THREE of the following are valid reasons to perform a service version scan (-sV) during a penetration test?

Accepted Answer

To identify vulnerabilities associated with specific software versions.. Service version scanning is essential for identifying potential exploits, mapping the attack surface, and gathering intelligence about the target environment. By identifying specific software and version numbers, a tester can cross-reference them with known vulnerabilities. This process transforms a simple list of open ports into a prioritized list of targets, which is the core objective of the reconnaissance and vulnerability assessment phase of any professional security engagement.

Answer

To bypass IDS/IPS signatures by altering the service response.

Answer

To increase the scan speed for large network subnets.

Question 6

You are performing a network discovery scan and want to identify which operating systems are running on your targets. Which TWO Nmap flags or combinations are most appropriate for this task?

Accepted Answer

-O (Enable OS detection). OS fingerprinting is a critical step in reconnaissance. Using -O is the native flag for OS detection, but it often needs to be paired with other techniques to ensure accuracy. Understanding how to use these flags correctly is essential for testers who need to tailor their exploitation attempts to specific target platforms, ensuring that the chosen payloads match the underlying architecture and service configurations discovered.

Answer

-sV (Service Version Detection)

Answer

-sP (Ping scan)

Answer

--script=banner

Question 7

During a scan, you receive a 'filtered' status on most ports. You want to determine if this is because of a network-based IPS or a host-based firewall. Which Nmap technique would best assist in differentiating between these two possibilities?

Accepted Answer

-sA (ACK Scan). The TCP ACK scan (-sA) is specifically designed to map firewall rule sets. By sending ACK packets, you can determine if a port is 'unfiltered' (meaning it can be reached) or 'filtered' (meaning a device is dropping packets). This is a vital skill for testers to determine if the filtering is occurring at the network perimeter or the host, which changes the strategy for potential bypass techniques.

Answer

-sS (SYN Scan)

Answer

-sU (UDP Scan)

Answer

-sN (Null Scan)

Question 8

During an internal penetration test, you discover that the target network uses a stateful firewall that blocks TCP SYN packets to most ports but permits TCP ACK packets to any port. You need to enumerate live hosts and open ports while avoiding detection. Which Nmap scan technique should you use to bypass the firewall's filtering and identify accessible services?

Accepted Answer

TCP ACK scan (-sA). A TCP ACK scan is specifically designed to map firewall rulesets and determine which ports are filtered versus unfiltered. In this scenario, the stateful firewall blocks SYN packets but allows ACK packets, making the ACK scan effective for discovering accessible hosts and ports. It does not provide service version information but is ideal for bypassing the filtering and identifying reachable services.

Answer

TCP Maimon scan (-sM)

Answer

TCP FIN scan (-sF)

Answer

TCP Xmas scan (-sX)

Question 9

You are performing a penetration test and need to discover live hosts on a subnet. The client has requested that you minimize network traffic and avoid triggering intrusion detection systems. Which Nmap host discovery technique is most appropriate?

Accepted Answer

TCP SYN ping scan (-PS). A TCP SYN ping scan is an effective host discovery method that sends SYN packets to common TCP ports. It is stealthy because it resembles normal traffic and often bypasses firewalls that block ICMP. It generates minimal traffic, making it suitable for environments where minimizing network noise and avoiding IDS triggers are priorities. This technique balances reliability and stealth, making it the best choice among the options.

Answer

UDP ping scan (-PU)

Answer

ARP ping scan (-PR)

Answer

ICMP echo request scan (-PE)

Question 10

You are conducting an external penetration test and want to discover live hosts on a target network without performing a full port scan. Which two Nmap options are valid host discovery techniques that can be used with -sn? (Choose two.)

Accepted Answer

-PS. Both -PE and -PS are legitimate host discovery probes that work with -sn. ICMP echo requests are the traditional method, while TCP SYN pings to common ports provide a fallback when ICMP is filtered. The other options are enumeration features that require port scanning and are incompatible with -sn.

Answer

-A

Answer

-O

Answer

-sV

Question 11

You are conducting a penetration test and need to scan a target host that is protected by a firewall that drops all TCP packets with the SYN flag set, but allows TCP packets with the FIN flag set. You want to identify open TCP ports on the target. Which Nmap scan type should you use to bypass this firewall rule?

Accepted Answer

TCP FIN scan (-sF). The TCP FIN scan uses packets with only the FIN flag, which the firewall permits. By sending FIN packets, you can probe ports without triggering the SYN-blocking rule. Open ports ignore the packet, while closed ports respond with RST, allowing you to map open ports. This makes it the appropriate scan type for this firewall configuration.

Answer

TCP NULL scan (-sN)

Answer

TCP Xmas scan (-sX)

Answer

TCP SYN scan (-sS)

Question 12

You are performing a penetration test against a target that has a firewall configured to drop all incoming TCP packets with the SYN flag set. You need to determine if a specific TCP port is open. Which Nmap scan type is most likely to succeed in this scenario?

Accepted Answer

TCP FIN scan (-sF). The TCP FIN scan sends packets without the SYN flag, so it can bypass a firewall that drops SYN packets. It can determine if a port is closed (RST response) or open|filtered (no response). The other scans either use SYN packets (blocked) or do not determine port openness.

Answer

TCP ACK scan (-sA)

Answer

TCP SYN scan (-sS)

Answer

TCP connect scan (-sT)

Question 13

You are performing a network audit and need to identify live hosts across a segmented network while minimizing the risk of triggering IDS alerts. Which Nmap technique is most appropriate for stealthy host discovery in a subnet where ICMP echo requests are filtered by the firewall?

Accepted Answer

Utilize TCP SYN ping (-PS) on common service ports.. Nmap's TCP SYN ping (-PS) is highly effective because it sends a small SYN packet to specified ports, like 80 or 443, which are typically open or acknowledged by firewalls. This bypasses ICMP filters while mimicking legitimate traffic. Understanding how to circumvent basic perimeter defenses is critical for penetration testers to ensure comprehensive discovery without alerting security systems that monitor for common ICMP-based scanning patterns or heavy traffic floods.

Answer

Perform a standard ICMP echo sweep (-PE).

Answer

Execute a full TCP connect scan on all ports (-sT).

Answer

Run an ARP scan across the entire subnet (-PR).

Question 14

Refer to the exhibit. You executed an Nmap scan against a host and received the output shown. Which scanning technique was most likely used to produce this specific state-based output while avoiding the completion of a full TCP three-way handshake?

Accepted Answer

TCP SYN Scan (-sS). The output indicates open ports without explicitly showing a full connection. Nmap's SYN scan (-sS) is the default and most popular method for this result. It initiates the handshake but sends an RST packet immediately after receiving the SYN/ACK, preventing a full connection. This technique is essential for testers to map services quickly while remaining stealthier than a full connection-based scan which would be logged by most application-layer firewalls.

Answer

TCP Connect Scan (-sT)

Answer

UDP Scan (-sU)

Answer

TCP ACK Scan (-sA)

Question 15

You are analyzing a target environment and need to identify UDP services. Which THREE of the following are significant challenges associated with performing an accurate UDP scan compared to a TCP scan?

Accepted Answer

UDP is connectionless, requiring Nmap to wait for a response that may never come.. UDP is a connectionless protocol, which creates inherent difficulties in scanning. Because there is no handshake, responses are inconsistent, leading to unreliable results. Testers must be aware that UDP scanning is often significantly slower and prone to false negatives due to rate-limiting by target hosts. Understanding these limitations is critical for reporting accurate service maps and knowing when to re-scan or verify results using alternative methods.

Answer

UDP ports must be scanned sequentially, preventing parallelization.

Answer

UDP packets are always blocked by stateful firewalls regardless of status.

Question 16

Refer to the exhibit. What is the primary purpose of the Nmap Scripting Engine (NSE) in the context of the output provided, and how does it improve upon standard port scanning?

Accepted Answer

To perform deep inspection of application-layer services.. The NSE allows for automated discovery of application-layer information, such as page titles, service versions, and even vulnerability checks. While basic scanning identifies that a port is open, the NSE probes the service to extract actionable intelligence. This is vital for penetration testers who need to quickly identify the function and potential risks of a service without manually interacting with every discovered endpoint during a large-scale reconnaissance operation.

Answer

To increase the speed of the port discovery phase.

Answer

To bypass firewalls by using script-based obfuscation.

Answer

To convert TCP scans into more reliable UDP scans.

Question 17

When conducting a network scan, you notice that many hosts are not responding to ping requests, even though they are known to be online. What is the most appropriate Nmap flag to use to ensure these hosts are still scanned for open ports?

Accepted Answer

-Pn (No ping). The -Pn flag is the standard solution when hosts are configured to drop ICMP traffic. It forces Nmap to skip the host discovery phase and proceed directly to port scanning, assuming that every target is 'up'. This is a fundamental technique for penetration testers, as security-conscious organizations often disable ICMP at the perimeter to prevent basic discovery by automated tools and internal network scanning.

Answer

-sP (Ping scan)

Answer

-PR (ARP ping)

Answer

-sn (Disable port scan)

Question 18

Refer to the exhibit. What does the Nmap status 'open|filtered' indicate about the target port, and why does this result commonly occur in penetration testing scenarios?

Accepted Answer

The port is likely open but the scanner is not receiving a clear response.. The 'open|filtered' state means Nmap cannot determine if the port is open or filtered. This happens when the port sends no response to a probe, which is typical behavior for firewalls that drop packets rather than rejecting them. Understanding this distinction is critical for testers, as it implies that the port might be open but protected, necessitating further probing to determine the true state of the service behind the security boundary.

Answer

The port is definitely open but the response was malformed.

Answer

The port is likely closed and the firewall is silently dropping traffic.

Answer

The port is definitely filtered and the service is unreachable.

Question 19

During an internal penetration test, you need to discover live hosts on a flat Layer 2 network segment. The client's IDS is known to alert on TCP SYN packets sent to closed ports. You want to minimize the chance of triggering an alert while still identifying as many hosts as possible. Which Nmap host discovery technique should you use?

Accepted Answer

nmap -sn -PR 10.10.10.0/24. ARP ping is the most reliable and stealthy host discovery method on a local Layer 2 network because ARP requests are broadcast and must be answered by all live hosts. It avoids TCP SYN traffic that would trigger the IDS described. The other options use TCP or ICMP probes that either trigger the IDS or are less reliable on a local segment.

Answer

nmap -sn -PS22,80,443 10.10.10.0/24

Answer

nmap -sn -PA80 10.10.10.0/24

Answer

nmap -sn -PE 10.10.10.0/24

Question 20

During an internal penetration test, you need to sweep a /24 subnet for live hosts using Nmap. The client's security team has confirmed that ICMP echo requests are blocked at the host firewall on all workstations, but they want you to use a technique that still elicits responses from hosts that are up without relying on ICMP. Which Nmap host discovery option should you use to maximize host detection in this environment?

Accepted Answer

nmap -sn -PS22,80,443 10.10.10.0/24. A TCP SYN ping (-PS) to common ports like 22, 80, and 443 is effective when ICMP is blocked because it uses TCP handshake responses to determine host liveness. The -sn flag suppresses port scanning and focuses on discovery. This combination reliably identifies live hosts that would otherwise be missed by ICMP-based methods.

Answer

nmap -sn -PP 10.10.10.0/24

Answer

nmap -sn -PE 10.10.10.0/24

Answer

nmap -sn -PR 10.10.10.0/24