CCNA Information Gathering And Vulnerability Scanning Questions

Why this answer

How to eliminate wrong answers

Option A is wrong because a payload causing a different error unrelated to SQL injection would still require the scanner to misinterpret that error as SQL injection, which is essentially the same mechanism as matching a generic error message; the core issue is the scanner's inability to distinguish error types, not the error's origin. Option B is wrong because stored XSS would manifest as injected script execution in stored content, not as an SQL injection flag from a vulnerability scanner; the scanner would need to detect script reflection or execution, not an SQL error pattern.

Why this answer

How to eliminate wrong answers

Option B (smb-enum-shares.nse) is wrong because it enumerates shared folders and their permissions, not vulnerability detection; it cannot determine if the host is vulnerable to EternalBlue. Option C (smb-os-discovery.nse) is wrong because it attempts to retrieve the Windows operating system version via SMB, which may provide context but does not test for the specific MS17-010 vulnerability.

Why this answer

How to eliminate wrong answers

Option A is wrong because a WAF blocking the payload would typically result in a different HTTP response (e.g., 403 Forbidden or a custom block page), not a false positive; the scanner would likely report the request as blocked or fail to get a response, not misinterpret a reflection. Option C is wrong because outdated signatures would more likely cause missed vulnerabilities (false negatives) rather than false positives; the issue here is the scanner's detection logic, not signature age. Option D is wrong because a generic 'Invalid input' message would actually reduce false positives, as the scanner would not see a reflection of its payload; the problem is the opposite—the API reflects the payload, which the scanner misinterprets as success.

Why this answer

How to eliminate wrong answers

Option B is wrong because a 405 error is not returned when a resource does not exist; that scenario would typically produce a 404 Not Found, regardless of the HTTP method used. Option C is wrong because if the server did not support the PUT method at all, it would likely return a 501 Not Implemented error, not a 405. Option D is wrong because a malformed request would result in a 400 Bad Request error, not a 405, which is specifically about the method being disallowed for the target resource.

Why this answer

Why this order

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because performing a full TCP SYN scan on an entire /64 subnet (2^64 addresses) is impractical and would generate an enormous number of packets, defeating the goal of discovering hosts without sending many packets; it is also inefficient and likely to be detected or blocked. Option C is wrong because requesting the DHCPv6 server log from the network administrator relies on human cooperation and may not be feasible during a penetration test, and it does not involve the tester actively discovering hosts; additionally, many IPv6 networks use stateless address autoconfiguration (SLAAC) rather than DHCPv6, so the log may not contain all active addresses.

Why this answer

How to eliminate wrong answers

Option A is wrong because scanning the target's IP ranges for open port 443 (HTTPS) does not specifically identify S3 buckets; S3 buckets are hosted on Amazon's infrastructure (e.g., s3.amazonaws.com) and not on the target's own IP ranges, so this would miss buckets entirely. Option B is wrong because dnsdumpster.com is used for DNS enumeration to find subdomains, but S3 bucket names are not DNS subdomains of the target company; they are separate AWS resources with names like 'bucket-name.s3.amazonaws.com' that do not appear in the target's DNS records. Option C is wrong because guessing bucket names based on common patterns is inefficient and unreliable; while it might occasionally succeed, it is not the most effective method compared to using search engines that index actual bucket URLs.

Why this answer

How to eliminate wrong answers

Option B is wrong because deleting the finding ignores the presence of the vulnerable package, which could be enabled later by an administrator or attacker, leading to a false sense of security. Option C is wrong because reporting it as critical without context disregards the tester's responsibility to validate scanner results and adjust risk based on actual exploitability, as the service is disabled and unreachable. Option D is wrong because enabling the service to exploit it is unethical, violates testing scope, and could cause unintended disruption or security breaches.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because nmap is a general-purpose network scanner that can discover open ports and services, but it is not specifically designed for enumerating SMB user accounts and shares without authentication; it requires scripts like smb-enum-users.nse to perform such tasks, and even then it is not the dedicated tool for this purpose. Option C is wrong because smbclient is an interactive SMB client used to access shared resources after authentication or with a null session, but it is not primarily designed for enumeration of user accounts and shares without authentication; it requires manual interaction and does not automate the enumeration process. Option D is wrong because hydra is a password brute-forcing tool used for attacking authentication services, not for enumerating user accounts or SMB shares without authentication; it requires valid credentials or a list of usernames to attempt logins.

Why this answer

How to eliminate wrong answers

Option A is wrong because ARP cache poisoning from the switch is not a standard attack vector; ARP spoofing targets end hosts, not the switch's ARP cache, and switches do not maintain ARP caches for forwarding decisions in the same way routers do. Option B is wrong because MAC flooding overwhelms the switch's CAM table to force it into hub mode, which can allow sniffing within the same VLAN but does not bypass Private VLAN isolation, as Private VLANs enforce traffic restrictions at the switch level regardless of CAM table state. Option C is wrong because double tagging is a VLAN hopping technique that works by adding two 802.1Q tags to a frame, but it is effective only against trunk ports with native VLAN mismatches and does not directly bypass Private VLAN isolation, which operates on access ports with Private VLAN configuration.

Why this answer

How to eliminate wrong answers

Option A is wrong because using 'nslookup' to query the domain's DNS server involves direct DNS queries to the target's authoritative servers, which is active reconnaissance and can be logged or detected. Option C is wrong because performing a DNS zone transfer requires a direct connection to the target's DNS server and typically fails unless the server is misconfigured to allow unauthorized transfers; it is also an active technique that generates network traffic.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because using 'nslookup' interactively sends DNS queries directly to the target's DNS servers (or configured resolvers), which violates the requirement of not making direct requests to the target's own DNS servers. Option B is wrong because performing a zone transfer (AXFR) requires a direct TCP connection to the target's authoritative DNS server on port 53, and most modern DNS servers are configured to deny zone transfers except to authorized secondary servers, making it both a direct request and often unsuccessful.

Why this answer

How to eliminate wrong answers

Option B is wrong because attempting to crack the passwords is an active exploitation step that goes beyond passive information gathering and violates the scope of engagement without prior authorization. Option C is wrong because documenting the findings and proceeding with passive reconnaissance ignores the urgency of exposed credentials, which could be exploited by malicious actors in the meantime. Option D is wrong because using the credentials to log into the target system immediately constitutes unauthorized access and is a violation of ethical hacking principles and legal boundaries.

Why this answer

How to eliminate wrong answers

Option B (DNS brute forcing) is wrong because it involves sending DNS queries to the target's name servers to enumerate subdomains, which generates network packets and active interaction with the target's systems. Option C (WHOIS lookup) is wrong because while it is passive, it typically returns administrative and technical contact emails (e.g., admin@example.com) rather than a broad set of user email addresses associated with the domain, and it queries public WHOIS databases, not the target's own systems.

Why this answer

How to eliminate wrong answers

Option A is wrong because DNS zone transfer (AXFR) requires the target's DNS server to be misconfigured to allow unrestricted zone transfers, and it directly queries the target's DNS server, which would be detected. Option B is wrong because brute-force subdomain enumeration using a wordlist involves sending numerous DNS queries to the target's DNS servers to test each subdomain, generating detectable traffic and defeating the requirement to avoid direct queries.

Why this answer

How to eliminate wrong answers

Option B is wrong because DNS zone transfer (AXFR) is not a public record technique; it requires explicit server configuration to allow transfers, and modern DNS servers almost always restrict it to authorized secondary nameservers, making it a high-risk, active technique that rarely succeeds against hardened targets. Option C is wrong because using Nmap to brute-force subdomains is an active scanning technique that generates network traffic to the target's DNS servers, which is not 'using only public records' and can be detected or blocked, unlike passive methods.

Why this answer

How to eliminate wrong answers

Option A is wrong because scanning open ports on the target web server requires sending TCP or UDP packets to the target, which constitutes active reconnaissance as it directly interacts with the target's systems. Option C is wrong because sending a crafted ICMP echo request (ping) to the target is an active probe that elicits a response from the target's network stack, making it active reconnaissance, not passive.

Why this answer

How to eliminate wrong answers

Option A is wrong because an outdated vulnerability database would more likely cause false negatives (missing real vulnerabilities) rather than false positives; a false positive typically arises from over-aggressive or version-based detection, not from missing patches. Option B is wrong because if the vulnerability was already patched in that version, the scanner should not report it based on the HTTP response header; this scenario would indicate a scanner misconfiguration or a bug, not a typical false positive cause, and the question specifies the application is not vulnerable, not that it was patched.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing scan intensity sends more payloads, which would likely increase the number of oversized payloads and thus increase false positives, not reduce them. Option C is wrong because increasing the HTTP request timeout only affects how long the scanner waits for a response; it does not change the payload size or content, so it cannot reduce false positives caused by payload truncation or rejection.

Why this answer

How to eliminate wrong answers

Option B (T1 - Sneaky) is wrong because, while slower than normal, it sends packets at intervals of 15 seconds, which is still too fast for environments where the IDS has a low threshold for connection attempts and may still trigger alerts. Option C (T3 - Normal) is wrong because it uses the default timing template with no deliberate delay, sending packets as fast as the network and target allow, which is highly likely to be detected by any IDS monitoring for scan patterns.

Why this answer

How to eliminate wrong answers

Option A is wrong because a full TCP connect scan completes the three-way handshake on every port, generating a high volume of traffic and easily triggering alerts on firewalls or intrusion detection systems. Option B is wrong because an ICMP echo request sweep sends ICMP packets that are often blocked or filtered by network devices, and the broadcast nature of ICMP can still produce noticeable traffic and alerts. Option C is wrong because a SYN stealth scan on ports 80 and 443, while stealthier than a full connect scan, still sends TCP SYN packets that traverse Layer 3 and can be detected by network monitoring tools; it also limits discovery to only two ports, potentially missing live hosts that do not have those services open.

Why this answer

Why this answer

How to eliminate wrong answers

Option A (SYN scan) is wrong because it is the technique that already failed—sending SYN packets to port 443 received no response, so repeating the same scan will not yield different results. Option C (UDP scan) is wrong because port 443 is used for HTTPS (TCP), not UDP; a UDP scan would be irrelevant for confirming a TCP-based service. Option D (Idle scan) is wrong because it is a stealth technique used to spoof the source IP via a zombie host, not a method to confirm a service when SYN packets are filtered; it would still rely on SYN packets and would not bypass the filtering issue.

Why this answer

How to eliminate wrong answers

Option A is wrong because SQL injection is a web application vulnerability caused by improper input sanitization in database queries, not a flaw in the OpenSSL cryptographic library. Option B is wrong because cross-site scripting (XSS) is a client-side injection vulnerability in web applications, unrelated to the OpenSSL protocol implementation. Option C is wrong because while Heartbleed is technically a buffer over-read (a type of memory safety issue), the term 'buffer overflow' typically refers to a buffer write overflow (e.g., stack or heap overflow) that allows code execution, whereas Heartbleed is a read-only over-read that leaks memory contents without allowing arbitrary code execution.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because searching for exposed Confluence login pages on Shodan requires active scanning of the target's IP ranges, which constitutes active interaction with the target's systems, violating the requirement to avoid active interaction. Option C is wrong because the Wayback Machine archives historical snapshots of publicly accessible web pages, but it would only contain references to the Confluence wiki if those pages were previously publicly accessible on the internet, which is unlikely for an internal-only wiki. Option D is wrong because performing a zone transfer on the target's DNS servers is an active DNS query technique that requires direct interaction with the target's DNS infrastructure, and most modern DNS servers are configured to deny zone transfers to unauthorized hosts.

Why this answer

How to eliminate wrong answers

Option B is wrong because sending ARP requests as part of a ping sweep generates packets on the network, violating the requirement to avoid sending any packets. Option C is wrong because querying the local DNS server sends a DNS query packet, which is an active network request; it also may not reveal all host records due to DNS caching or security configurations like zone transfer restrictions.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a TCP connect scan uses the full three-way handshake (SYN, SYN-ACK, ACK), which is easily logged by the target system and detected by IDS as a standard connection attempt. Option B is wrong because a SYN scan (half-open scan) sends a SYN packet and waits for a SYN-ACK, but many IDS systems are specifically configured to flag rapid SYN packets as a port scan, making it more detectable than a FIN scan.

Why this answer

How to eliminate wrong answers

Option A is wrong because Nmap's -sV flag performs an active service scan that sends probes to the target's servers to determine service versions, which violates the passive reconnaissance requirement. Option B is wrong because Shodan.io is a search engine for internet-connected devices and services, but it primarily relies on active scanning data from its own crawlers and may not provide detailed web application technology stacks like frameworks or libraries without making requests to the target.

Why this answer

How to eliminate wrong answers

Option A is wrong because HTTP method differences (e.g., GET vs POST) could cause the scanner to test a different endpoint, but the question states the same payload was used; if the scanner used a different method, manual testing with the same method would still match. Option B is wrong because URL encoding differences (e.g., %27 vs ') would be normalized by the browser or server; manual testing typically uses the same encoding as the scanner's output. Option C is wrong because the scanner does not create a simulated environment; it sends real HTTP requests to the live web application, so the vulnerability cannot exist only in a simulated environment.

Why this answer

How to eliminate wrong answers

Option A is wrong because theHarvester actively queries public sources like search engines and PGP key servers, which can generate logs or rate-limiting alerts that the target might detect if they monitor for reconnaissance activity. Option B is wrong because sending probe emails directly interacts with the target's email infrastructure, triggering SMTP logs, SPF/DKIM checks, and potentially alerting security teams via email security gateways or honeypot accounts. Option C is wrong because scraping LinkedIn profiles requires automated access to LinkedIn's platform, which can be detected by LinkedIn's anti-scraping mechanisms and rate limiting, and the target may monitor for unusual profile viewing patterns.

Why this answer

How to eliminate wrong answers

Option B is wrong because scanning all ports is achieved by the -p 1-65535 argument, not by -sC. Option C is wrong because performing a version scan is the purpose of -sV, not -sC. Option D is wrong because a SYN scan is the default scan type when run as root, but it is explicitly invoked with -sS, not -sC.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because DNS zone transfer requires a direct connection to the target's DNS server and is typically disabled for security reasons (e.g., via allow-transfer restrictions), making it unreliable and not passive. Option B is wrong because WHOIS lookup provides registration details like domain ownership and contact information, but it does not disclose internal IP address schemes or subnetting practices.

Why this answer

How to eliminate wrong answers

Option A is wrong because a firewall that drops all packets would cause no SYN-ACK responses at all, not just a few; the tester received SYN-ACK replies, so packets are not being universally dropped. Option C is wrong because a stealthy IDS (Intrusion Detection System) monitors traffic and may generate alerts but does not alter TCP handshake responses; the SYN-ACK replies are a network-layer behavior from the target host, not an IDS action.

Why this answer

How to eliminate wrong answers

Option B is wrong because a DNS zone transfer is an active query that sends a request to the target's DNS server, and it typically reveals internal hostnames, not web server software or version banners. Option C is wrong because using netcat to connect to port 80 sends a TCP SYN packet to the target, which is an active technique that generates network traffic and can be detected. Option D is wrong because nmap -sV performs active service version detection by sending probes to open ports, even with a delayed scan, it still transmits packets to the target infrastructure.

Why this answer

How to eliminate wrong answers

Option B is wrong because a misconfigured plugin that sends malformed packets would likely cause a different error or no response at all, not a high-confidence false positive; Heartbleed detection relies on the server echoing back more data than requested, not on malformed packets. Option C is wrong because Heartbleed detection does not rely on generic error messages; it specifically checks for an oversized heartbeat response payload (e.g., a 64KB reply to a 1-byte request). Option D is wrong because intermittent network connections would produce incomplete or dropped responses, which would typically result in a low-confidence or inconclusive scan result, not a high-confidence false positive.

Why this answer

How to eliminate wrong answers

Option A is wrong because `-p-` scans all 65535 TCP ports, which generates maximum traffic and takes the longest time, directly contradicting the requirement to minimize network traffic and scan time. Option C is wrong because `-sn` performs a ping sweep (host discovery) using ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests; it does not scan any ports for open/closed status, so it cannot identify open ports. Option D is wrong because `-sV` enables version detection, which probes open ports to determine service versions, but it does not limit the port range to the top 100; without `-F`, it scans the default 1000 ports, and the version probing adds significant traffic and time, making it inefficient for the stated goal.

Why this answer

How to eliminate wrong answers

Option B is wrong because `-A` enables aggressive scanning (OS detection, version detection, script scanning, traceroute) and `-T4` sets a faster timing template, which can overwhelm the server and is not focused solely on SSL/TLS configuration weaknesses. Option C is wrong because `-sU` performs a UDP scan, but HTTPS (port 443) uses TCP, so this command would not properly assess the SSL/TLS configuration. Option D is wrong because `-sC` runs default NSE scripts, which may include some SSL-related checks but does not specifically enumerate ciphers and protocols in a targeted, non-overwhelming manner like `ssl-enum-ciphers` does.

Why this order

Why this answer

How to eliminate wrong answers

Option A is wrong because a DNS brute-force attack sends DNS queries to the target's authoritative name servers, which are packets that reach the target's network infrastructure, making it an active technique. Option C is wrong because sending ICMP echo requests (ping) to potential subdomain IP addresses directly transmits packets to the target's network, which is active reconnaissance and violates the 'no packets' constraint. Option D is wrong because querying WHOIS databases retrieves registration information (e.g., registrar, contacts) but does not discover subdomains; WHOIS records typically contain domain ownership details, not subdomain listings.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because nmap OS fingerprint scan actively sends TCP/IP probes (e.g., SYN, FIN, NULL packets) to the target host, generating network traffic. Option C is wrong because a ping sweep sends ICMP Echo Request packets to multiple hosts, which directly generates traffic on the target network. Option D is wrong because ARP scanning sends ARP request broadcasts to the local network segment, which creates traffic and only works for hosts on the same Layer 2 domain, not a remote host.

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling SYN scan (a half-open scan) only changes the TCP handshake method to reduce network noise and avoid connection logging, but it does not prevent the scanner from sending exploit payloads that crash services. Option B is wrong because adjusting the scan timing template to a slower rate reduces packet transmission speed to avoid network congestion or IDS alerts, but it does not disable the intrusive exploit attempts that cause service crashes. Option D is wrong because increasing the port range to include high ports expands the scope of the scan to discover more services, but it does not mitigate the aggressive exploitation behavior that crashes services.

Why this answer

How to eliminate wrong answers

Option B is wrong because it lacks the `filetype:` operator, so it returns general web pages containing the words 'username' and 'password' rather than specific document files. Option C is wrong because it targets `filetype:xls` (Excel files), not PDF documents as specified in the question. Option D is wrong because `intitle:'index of'` is used to find directory listings, not PDF documents, and it does not include `filetype:pdf` to filter for PDFs.

Why this answer

How to eliminate wrong answers

Option A is wrong because a direct DNS zone transfer is an active reconnaissance technique that requires a misconfigured DNS server to allow AXFR requests, whereas theHarvester performs passive reconnaissance without interacting with the target's DNS servers. Option B is wrong because Shodan is a search engine for internet-connected devices and services, but theHarvester does not natively integrate Shodan as a source for email and subdomain collection; it focuses on search engines and PGP key servers. Option C is wrong because while Baidu is a search engine, theHarvester's common configurations prioritize Google and Bing due to their broader coverage and API accessibility for passive OSINT gathering.

Why this answer

How to eliminate wrong answers

Option A is wrong because an Nmap SYN scan sends crafted TCP SYN packets to the target, which is an active reconnaissance technique that can be detected by firewalls and IDS/IPS. Option C is wrong because brute-force login attempts actively send authentication requests to a service, generating logs and potentially triggering account lockout or alerting mechanisms. Option D is wrong because a Netcat banner grab requires establishing a TCP connection to the target service, which is an active interaction that can be logged and detected.

Why this answer

How to eliminate wrong answers

Option A is wrong because DNS cache snooping reveals cached queries (e.g., recently resolved domains) but does not enumerate internal hosts or network ranges; it only shows what has been queried. Option C is wrong because querying for all SRV records only returns service-specific records (e.g., _ldap._tcp.domain.com) and does not provide a full list of hosts or network ranges; it is not a comprehensive enumeration technique.

Why this answer

How to eliminate wrong answers

Option A is wrong because MySQL runs over TCP, not UDP; port 3306 is a TCP port, and a UDP scan would be irrelevant and waste time. Option B is wrong because attempting default credentials without first identifying the MySQL version or understanding the authentication mechanism is premature and could alert the target or lock out accounts. Option D is wrong because scanning for other hosts with port 3306 open is a broad reconnaissance step that should occur after understanding the current target's service details, not before.

Why this answer

How to eliminate wrong answers

Option A is wrong because DNS enumeration with tools like `dnsrecon` involves actively querying DNS servers, which generates network traffic to the target's authoritative name servers or resolvers, making it an active reconnaissance technique rather than passive. Option C is wrong because querying certificate transparency logs (e.g., via crt.sh) is a passive technique, but it reveals SSL certificates and domain names, not cloud storage buckets; it does not directly identify publicly accessible storage endpoints like S3 buckets.

Why this answer

How to eliminate wrong answers

Option A is wrong because the whois command queries domain registration details from WHOIS servers, which are not part of the target's infrastructure but still involve sending DNS queries that could be logged or traced, and it does not directly discover email addresses associated with the domain. Option B is wrong because Shodan actively scans the internet for exposed devices and services, including email servers, which involves sending packets to the target's infrastructure and is not passive reconnaissance. Option C is wrong because Google dorking uses search engines to find indexed pages, which is passive, but it is less efficient and targeted for discovering email addresses compared to theHarvester, which automates the process across multiple public sources.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the Heartbleed bug (CVE-2014-0160) is a vulnerability in OpenSSL, not Apache Struts2, and is detected by Nmap scripts like 'ssl-heartbleed', not 'http-vuln-cve2017-5638'. Option C is wrong because the Shellshock Bash vulnerability (CVE-2014-6271) affects the Bash shell and is typically exploited via CGI scripts, not through Apache Struts2's Jakarta Multipart parser, and is detected by scripts such as 'http-shellshock'.

Why this answer

Why this answer

How to eliminate wrong answers

Option B ({{7*'7'}}) is wrong because in Handlebars, multiplying a number by a string may cause a type error or unexpected behavior, not a clean numeric result, making it less reliable for SSTI detection. Option C (<%= 7*7 %>) is wrong because this is an ERB-style tag used in Ruby or other frameworks, not in Handlebars or Express/Node.js. Option D (${7*7}) is wrong because this is JavaScript template literal syntax, which is client-side and not processed by the server-side Handlebars engine.

Why this answer

How to eliminate wrong answers

Option A is wrong because Shodan is a search engine for internet-connected devices that actively probes and indexes banners from services, but it relies on its own active scanning infrastructure, not passive gathering from the tester's perspective; the tester does not send packets, but Shodan itself does. Option B is wrong because Nmap with -sT scan performs a TCP connect scan, which sends SYN and ACK packets to the target, making it an active scanning technique that violates the requirement of not sending any packets.

Why this answer

How to eliminate wrong answers

Option A is wrong because nmap is a network scanning tool focused on port discovery and service fingerprinting, not DNS-specific brute-force enumeration; while it can perform DNS queries via scripts, it lacks the dedicated subdomain brute-force functionality of dnsrecon. Option C is wrong because Wireshark is a packet analyzer used for capturing and inspecting network traffic, not for actively generating DNS queries to enumerate subdomains.

Why this answer

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because an ARP scan using arp-send sends ARP request packets onto the network, which can be detected by network monitoring tools or intrusion detection systems, violating the 'no packets sent' constraint. Option C is wrong because Nmap with the -sn flag performs a ping sweep that sends ICMP echo requests, TCP SYN packets to port 443, or ARP probes (depending on privileges), all of which generate detectable network traffic.

Why these pairings

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a TCP connect scan completes the full three-way handshake for every port, generating a high volume of packets and stateful connections that can degrade server performance, especially on a critical production system. Option C is wrong because an aggressive Nmap scan (e.g., using -T4 or -T5 timing templates, service version detection, and OS fingerprinting) sends a high rate of probes and performs multiple concurrent tests, which can overwhelm a production server and cause latency or resource exhaustion. Option D is wrong because a stealth SYN scan, while less intrusive than a connect scan, still sends a large number of raw SYN packets in rapid succession (often with default timing), which can still cause performance degradation on a production server if not rate-limited; it does not inherently minimize impact.

Why this answer

How to eliminate wrong answers

Option B is wrong because sending DNS queries for common bucket name prefixes (e.g., companyname-bucket.s3.amazonaws.com) is an active reconnaissance technique that generates DNS traffic and can be logged by the organization's DNS servers or AWS, violating the passive nature required. Option C is wrong because nmap scanning of AWS IP ranges is active reconnaissance that sends packets to AWS infrastructure, potentially triggering alerts, and S3 buckets are accessed via HTTPS on port 443, not by scanning for open ports on arbitrary IPs.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `nbtstat -A` does not reveal OS version or patch level; that information is typically obtained via tools like `nmap` OS fingerprinting or SMB version queries. Option B is wrong because `nbtstat` operates at the NetBIOS layer (port 137-139) and does not enumerate open TCP ports; port scanning requires tools like `nmap` or `netstat`. Option C is wrong because while NetBIOS can sometimes reveal MAC addresses via the <00> or <03> entries in the name table, the primary purpose of `nbtstat -A` is to retrieve the full NetBIOS name table, not specifically the MAC address; ARP or `getmac` would be more direct for MAC address enumeration.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an ARP scan only works within the same local subnet (broadcast domain) and cannot discover hosts across routers, making it unsuitable for a large subnet that may span multiple networks. Option C is wrong because a DNS zone transfer is a technique for enumerating DNS records (e.g., hostnames and IPs) from a misconfigured DNS server, not for actively probing live hosts, and it relies on a vulnerable server rather than direct network scanning. Option D is wrong because an ICMP echo sweep (ping sweep) can be blocked by firewalls or rate-limited, and it generates more traffic than a targeted TCP SYN scan on two ports, making it less efficient and more detectable.