CCNA Footprinting, Reconnaissance and Scanning Questions

Why this answer

How to eliminate wrong answers

Option A is wrong because DNSSEC (DNS Security Extensions) provides data integrity and authentication via digital signatures, but it does not control or prevent zone transfers; a server can have DNSSEC enabled and still allow unauthorized AXFR. Option B is wrong because recursive queries allow the DNS server to resolve queries for external domains on behalf of clients, which is a separate setting (often controlled by 'allow-recursion') and not directly related to zone transfer permissions. Option D is wrong because being authoritative for a domain means the server holds the official zone data for that domain, which is normal and expected; the security issue is not that it is authoritative, but that it allows zone transfers from any host without restriction.

Why this answer

How to eliminate wrong answers

Option A is wrong because `site:admin login` is not a valid Google dork; `site:` requires a domain name, not a keyword, and 'admin login' as a search phrase would just match pages containing those words anywhere, not specifically in the URL. Option B is wrong because `filetype:pdf admin login` restricts results to PDF files, which is irrelevant for finding login pages (typically HTML/ASPX/PHP), and the terms 'admin' and 'login' are searched in the page content, not the URL. Option C is wrong because `intitle:"login" inurl:admin` searches for pages with 'login' in the title and 'admin' in the URL, but this misses pages where 'login' is only in the URL (not the title), which is common for many admin login pages.

Why this answer

How to eliminate wrong answers

Option A is wrong because a subdomain brute-force uses a wordlist to guess subdomains, not the AXFR query type. Option C is wrong because a reverse DNS lookup queries an IP address for a PTR record, not a domain for a zone transfer. Option D is wrong because SRV record enumeration uses the `-t srv` flag or similar, not `-t axfr`, which is specific to zone transfers.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'inurl:admin' searches for URLs containing 'admin', which may return admin panels or directories but is less specific to login pages and often yields broader results like admin dashboards or configuration pages. Option C is wrong because 'site:example.com filetype:pdf' restricts results to PDF files on a specific domain, which is useful for document discovery but not for finding login pages. Option D is wrong because 'link:example.com' is a deprecated Google operator that lists pages linking to a given URL, not a method for locating login pages on the target server.

Why this answer

How to eliminate wrong answers

Option A is wrong because a CNAME (Canonical Name) record is an alias that maps one domain name to another, not a record that directly identifies mail servers. Option C is wrong because an A (Address) record maps a hostname to an IPv4 address; while it could resolve a mail server's hostname to an IP, it does not itself designate which servers handle mail for the domain. Option D is wrong because an NS (Name Server) record delegates a zone to authoritative name servers, not mail servers.

Why this answer

How to eliminate wrong answers

Option B is wrong because 'site:example.com -www' restricts results to the domain 'example.com' while excluding subdomains containing 'www', which is useful for narrowing scope but does not specifically target login pages. Option C is wrong because 'filetype:pdf' limits results to PDF files, which are documents, not interactive login pages; it is used for finding documents, not web application endpoints. Option D is wrong because 'link:example.com' is a deprecated Google operator that used to find pages linking to a specific URL; it does not search for login pages and is no longer supported by Google.

Why this answer

How to eliminate wrong answers

Option A is wrong because OS detection is enabled with the -O flag, not -sS. Option C is wrong because a UDP scan is performed using the -sU flag, which sends UDP packets to target ports. Option D is wrong because a TCP connect scan uses the -sT flag, which completes the full three-way handshake using the operating system's connect() system call, unlike the half-open SYN scan.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because theHarvester does not capture live network traffic; that is the function of packet sniffers like tcpdump or Wireshark, which operate at the data-link layer. Option B is wrong because theHarvester does not extract password hashes; hash retrieval is typically performed by tools like Hashcat or John the Ripper after obtaining a password database dump. Option D is wrong because theHarvester does not perform vulnerability scanning; vulnerability assessment is done by tools like Nessus or OpenVAS, which actively probe services for known CVEs.

Why this answer

How to eliminate wrong answers

Option B is wrong because the `-f` flag does not control scan timing; slowing down to avoid rate-based alarms is achieved with the `-T` (timing) flags, such as `-T0` or `-T1`. Option C is wrong because sending packets from multiple decoy IP addresses is the function of the `-D` (decoy) flag, not `-f`. Option D is wrong because spoofing the source IP address is done with the `-S` flag or by using a spoofed source address in raw packets, not by fragmentation.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because vulnerability scanning is an active process that sends probes (e.g., SYN packets, HTTP requests) to identify weaknesses, directly interacting with target systems. Option B is wrong because social engineering involves manipulating people to divulge information, which requires direct interaction (e.g., phishing emails, phone calls) and is not a reconnaissance technique based solely on public sources. Option C is wrong because active reconnaissance involves direct engagement with the target's systems (e.g., port scanning with Nmap, banner grabbing), generating traffic that can be logged or detected.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a SYN scan sends raw SYN packets and does not spoof the source IP; the attacker's real IP would be directly visible in the IDS logs, not a legitimate internal server. Option B is wrong because an idle scan (also known as a zombie scan) uses a third-party host (the zombie) with a predictable IP ID sequence to indirectly probe the target, but the scan traffic appears to come from the zombie, not from a legitimate internal server like 10.0.0.5. Option D is wrong because a fragmentation scan splits TCP headers into multiple small IP fragments to evade simple packet filters, but it does not alter the source IP address, so the attacker's real IP would still be logged.

Why this answer

How to eliminate wrong answers

Option B (Nmap) is wrong because Nmap is a network mapper and port scanner, not a vulnerability scanner; while it can detect open ports and services via scripts (NSE), it lacks a comprehensive vulnerability database and automated plugin-based assessment. Option C (Wireshark) is wrong because Wireshark is a packet analyzer used for deep inspection of network traffic, not for scanning systems for vulnerabilities; it captures and dissects packets but does not perform active vulnerability checks. Option D (Metasploit) is wrong because Metasploit is an exploitation framework designed to verify and exploit vulnerabilities after they are identified, not to conduct a broad vulnerability scan; using it for scanning would be inefficient and potentially destructive without prior assessment.

Why this answer

How to eliminate wrong answers

Option B (Ping sweep, -sn) is wrong because it only sends ICMP echo requests or TCP/UDP probes to determine if hosts are alive, not to establish TCP connections, so it cannot produce SYN_RECV states. Option C (TCP Connect scan, -sT) is wrong because it completes the full three-way handshake (SYN, SYN/ACK, ACK) and then sends a RST, leaving the connection in ESTABLISHED state only briefly, not in SYN_RECV. Option D (UDP scan, -sU) is wrong because UDP is connectionless and does not use SYN packets or maintain connection states like SYN_RECV.

Why this answer

How to eliminate wrong answers

Option B is wrong because theHarvester is a tool for gathering email addresses, subdomains, and other OSINT data from public sources like search engines and DNS records, not for performing live host discovery on a private IP range. Option C is wrong because Nmap's -sn ping sweep, while effective, is significantly slower than Masscan on a /16 range due to its stateful scanning approach, which creates more network overhead and takes much longer to complete. Option D is wrong because hping3 with --icmp sends packets sequentially to each IP, which is extremely slow and inefficient for scanning 65,536 hosts, and it does not minimize network load as it requires per-packet state tracking.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because DNS lookups use UDP or TCP port 53, not port 4444, and are not directed to a malicious IP for resolution; they query a DNS server. Option B is wrong because SIEM log forwarding typically uses ports like 514 (syslog), 1514, or 443 (HTTPS), not port 4444, and would not target a known malicious IP. Option D is wrong because a legitimate backup process would use standard backup ports (e.g., 445 for SMB, 22 for SSH, or 443 for HTTPS) and would not connect to a known malicious IP; false positives from vulnerability scans do not trigger outbound connections to attacker-controlled hosts.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Wireshark is a network protocol analyzer that captures and inspects live traffic in real time, which is an active sniffing technique requiring interaction with the network, not a passive reconnaissance tool for gathering OSINT from public sources. Option C is wrong because Metasploit is an exploitation framework used for developing and executing active exploits against vulnerabilities, not for passive information gathering like email or subdomain enumeration. Option D is wrong because Nmap is an active scanning tool that sends crafted packets (e.g., SYN, ICMP) to discover hosts and services, which generates network traffic and is not passive reconnaissance.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because DNS zone transfer information is obtained using the `dig axfr` or `nslookup -type=axfr` command against an authoritative DNS server, not via WHOIS. Option B is wrong because while WHOIS may list name servers, it does not directly return the IP address of the web server; that requires a DNS A-record lookup using `nslookup` or `dig`. Option C is wrong because open ports are discovered through port scanning tools like Nmap, not through the WHOIS protocol, which only returns registration metadata.

Why this answer

How to eliminate wrong answers

Option B is wrong because `-O` enables OS detection, which requires open ports and sends additional probes, making it slower and not focused on simple host discovery. Option C is wrong because `-p-` scans all 65535 TCP ports, which is a full port scan and extremely time-consuming for a /24 subnet, not a ping sweep. Option D is wrong because `-sV` performs service version detection on open ports, which requires a prior port scan and is not designed for host discovery.

Why this answer

How to eliminate wrong answers

Option A is wrong because using Netcat to grab banners requires establishing a TCP connection to the target's email server (e.g., port 25), which sends packets and is an active interaction. Option B is wrong because running an Nmap SYN scan sends crafted TCP SYN packets to the target's web server and analyzes responses, which is active reconnaissance and can be logged by intrusion detection systems. Option D is wrong because sending a ping sweep involves transmitting ICMP Echo Request packets to the target's IP range, directly probing live hosts and generating detectable traffic.

Why this answer

How to eliminate wrong answers

Option A is wrong because Nmap is a network scanning tool used for port discovery and service enumeration, not for generating high-volume attack traffic; it can send SYN packets for scanning but lacks the rate control and spoofing capabilities needed for a sustained SYN flood. Option B is wrong because Shodan is a search engine for internet-connected devices and does not generate any network traffic or perform attacks; it is used for reconnaissance, not exploitation. Option C is wrong because Wireshark is a packet analyzer used for capturing and inspecting network traffic, not for generating or injecting packets; it cannot initiate a SYN flood.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because DNSSEC (DNS Security Extensions) does not control or restrict zone transfers; it provides data origin authentication and integrity via digital signatures, but does not prevent AXFR queries. Option C is wrong because a properly configured DNS server would not respond to an AXFR request from an unauthorized source; the fact that the zone transfer succeeded proves the configuration is insecure, not properly configured. Option D is wrong because split-DNS (split-horizon) is a design where internal and external DNS views serve different records; it does not inherently prevent zone transfers, and the successful AXFR indicates a lack of access control, not a split configuration.

Why this answer

How to eliminate wrong answers

Option A is wrong because an open port would return a SYN/ACK, causing Nmap to report it as 'open', not 'filtered'. Option C is wrong because the 'filtered' state is determined by the scan probe response, not by the success or failure of the http-title script; the script would only run if the port were open. Option D is wrong because a closed port would send back an RST packet, leading Nmap to report it as 'closed', not 'filtered'.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the presence of multiple MX records is a standard configuration for resilience, not an indicator of compromise. Option B is wrong because multiple MX records point to distinct mail servers (with different hostnames or IPs), not a single server with multiple aliases (which would be CNAME records). Option D is wrong because multiple MX records are used for legitimate email routing, not for participating in a DDoS attack; DDoS involvement would be inferred from traffic patterns, not DNS record counts.

Why this answer

How to eliminate wrong answers

Option B is wrong because -T4 sets the timing template to aggressive, which increases scan speed but does not fragment packets or alter UDP probe structure. Option C is wrong because --reason simply displays the reason for Nmap's port state determination and has no effect on packet fragmentation or UDP response behavior. Option D is wrong because -Pn skips host discovery and treats the target as alive, but it does not fragment probes or change how UDP packets are constructed.

Why this answer

How to eliminate wrong answers

Option A is wrong because `-sS` (SYN scan) and `-O` (OS detection) do not fragment packets or spoof source IPs; they use raw packets with the real source IP. Option B is wrong because `-sV` (version detection) and `-p 80` target a single port without fragmentation or spoofing, generating normal TCP traffic. Option C is wrong because `-sU` (UDP scan) sends unfragmented UDP packets from the real source IP, not fragmented or spoofed traffic.

Why this answer

How to eliminate wrong answers

Option B is wrong because a firewall that blocks all inbound SYN packets would also block TCP connect scans, which rely on sending a SYN to initiate the handshake; the question states connect scans succeed, so this cannot be the case. Option C is wrong because packet fragmentation is an evasion technique used to bypass IDS/IPS signature matching, not to cause packets to be dropped; fragmented packets can still be reassembled and processed. Option D is wrong because a honeypot would respond to all connection attempts, including SYN scans, but the question states SYN scans return no results, indicating the packets are being dropped before reaching the target.

Why this answer

How to eliminate wrong answers

Option B is wrong because a ping sweep typically uses ICMP echo requests (or TCP SYN to common ports) and does not involve scanning UDP ports 161/162 or running an SNMP brute-force script. Option C is wrong because `-sU` scans UDP ports, not TCP ports, and the script is specifically for SNMP brute-forcing, not service enumeration. Option D is wrong because enumerating SNMP MIB tree values is done with scripts like `snmp-info` or `snmp-interfaces`, not the `snmp-brute` script, which focuses on guessing community strings.

Why this answer

How to eliminate wrong answers

Option A is wrong because the -f flag does not control timing; timing templates are set with -T0 through -T5 (e.g., -T5 for insane). Option B is wrong because an idle scan is performed using the -sI flag, not -f, and requires specifying a zombie host. Option C is wrong because spoofing a source IP address is achieved with the -S flag (e.g., -S 192.168.1.100), not -f.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a ping sweep sends ICMP Echo Request packets to multiple hosts, actively probing the target network. Option C is wrong because Netcat banner grabbing requires establishing a TCP connection to a target service (e.g., HTTP, FTP) to retrieve its banner, which involves sending packets. Option D is wrong because an Nmap SYN scan sends crafted TCP SYN packets to target ports to determine their state, actively interacting with the target.

Why this answer

How to eliminate wrong answers

Option A is wrong because exploitation involves actively leveraging a vulnerability to gain unauthorized access, such as using a buffer overflow or SQL injection, whereas this command only gathers information about the service. Option B is wrong because post-exploitation occurs after successful exploitation and focuses on maintaining access, privilege escalation, or data exfiltration; scanning port 80 is a pre-exploitation reconnaissance step. Option C is wrong because footprinting is the initial passive or semi-passive information gathering phase (e.g., WHOIS, DNS lookups, social engineering), while this nmap command actively sends packets to the target to enumerate services, which is scanning and enumeration.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (Wireshark) is wrong because it is a network protocol analyzer that captures and inspects packets in real time, not a vulnerability scanner; it lacks a plugin architecture for vulnerability detection. Option C (OpenVAS) is wrong because while it is also a vulnerability scanner using a plugin-like feed (NVTs), the question asks for the tool that is 'comprehensive' and uses a 'plugin architecture' — Nessus is the industry-standard commercial tool that pioneered this model, and OpenVAS is its open-source fork, but the CEH exam specifically recognizes Nessus as the correct answer for this description. Option D (Nmap) is wrong because it is primarily a port scanner and network mapper that uses scripts (NSE) for limited vulnerability detection, not a comprehensive vulnerability scanner with a dedicated plugin architecture for thousands of vulnerabilities.

Why this answer

How to eliminate wrong answers

Option B is wrong because a firewall blocking the scan would typically drop the packets or send ICMP unreachable messages, not respond with SYN-ACKs. Option C is wrong because a closed port would respond with RST packets, not SYN-ACKs, per RFC 793. Option D is wrong because while a stateful firewall might allow the connection, the SYN-ACK response itself is direct evidence that the port is open on the target host, not just a firewall behavior.

Why this answer

How to eliminate wrong answers

Option A is wrong because banner grabbing requires receiving and analyzing a service response, but `--flood` sends packets as fast as possible without waiting for replies, making banner capture impossible. Option B is wrong because OS fingerprinting relies on analyzing subtle differences in TCP/IP stack responses (e.g., TTL, window size), but the `--flood` mode overwhelms the target and does not collect or analyze response packets for fingerprinting. Option C is wrong because a TCP connect scan completes the three-way handshake (SYN, SYN-ACK, ACK), whereas this command only sends SYN packets and never completes the handshake, so it cannot identify open ports reliably.

Why this answer

How to eliminate wrong answers

Option B is wrong because discovering open ports is accomplished through port scanning (e.g., SYN scan, TCP connect scan), not banner grabbing, which occurs after a port is already known to be open. Option C is wrong because while banner information can sometimes hint at the OS, the primary and direct purpose of banner grabbing is to identify the service version, not the OS; OS detection is typically done via TCP/IP stack fingerprinting (e.g., nmap -O). Option D is wrong because mapping network topology involves techniques like traceroute, SNMP sweeps, or analyzing routing tables, not banner grabbing, which only interacts with a single service on a single host.

Why this answer

How to eliminate wrong answers

Option A is wrong because the command does not include `-A` (aggressive scan) nor any SMB enumeration flags like `--script smb-enum-shares`; it only scans four specific ports, not all open ports. Option C is wrong because `-sS` specifies a TCP SYN scan, not a UDP scan; a UDP scan would require `-sU`. Option D is wrong because `-sS` is a half-open SYN scan, not a full TCP connect scan (which uses `-sT`), and the command does not include UDP service detection or scan all ports.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because DNSSEC (DNS Security Extensions) provides data integrity and authentication through digital signatures, but it does not control or restrict the ability to perform a zone transfer; it only ensures that the zone data has not been tampered with. Option C is wrong because changing the default port of 53 to a non-standard port is not a viable countermeasure; DNS clients and servers expect port 53, and changing it would break normal DNS resolution, while an attacker can easily scan for the new port. Option D is wrong because disabling DNS recursion prevents the server from resolving queries for external domains on behalf of clients, but it does not affect the server's ability to perform or allow zone transfers, which are a separate function of authoritative DNS servers.

Why this answer

How to eliminate wrong answers

Option A is wrong because vulnerability scanning actively sends probes and packets to the target's systems to identify weaknesses, which directly interacts with the target and is not passive. Option C is wrong because active reconnaissance involves direct interaction with the target's systems (e.g., port scanning, ping sweeps), which violates the 'without directly interacting' condition. Option D is wrong because social engineering involves manipulating human targets through direct or indirect communication (e.g., phishing calls), which is an active technique and not based on public records.

Why this answer

How to eliminate wrong answers

Option A is wrong because `-sV` does not confirm the OS; OS detection is performed by the `-O` flag in the first scan, and version detection only identifies the application version, not the underlying OS. Option B is wrong because checking if a port is filtered by a firewall requires a different scan type, such as a SYN scan (`-sS`) with firewall evasion techniques or a scan that analyzes RST responses; `-sV` assumes the port is open and attempts a full connection to grab the service banner. Option D is wrong because `-sV` performs TCP version detection on the specified port (22), not a UDP scan; a UDP scan requires the `-sU` flag.

Why this answer

How to eliminate wrong answers

Option A is wrong because running two separate web servers on different ports would typically result in different version strings, build dates, or banner details; identical version output strongly suggests a single server instance. Option C is wrong because a reverse proxy (e.g., Nginx, HAProxy) would present its own banner on the listening ports, not the backend Apache version; the Nmap version detection directly queried the Apache service, not a proxy layer. Option D is wrong because Nmap version detection (-sV) uses probe-response matching against a signature database and is highly reliable for common services like Apache httpd; false positives are rare and would not produce identical version strings on two ports.

Why this answer

How to eliminate wrong answers

Option A is wrong because a port that responds with a banner would be classified as 'open', not 'filtered'. Option C is wrong because an open and actively listening port would respond with a SYN-ACK, leading Nmap to report it as 'open', not 'filtered'. Option D is wrong because a closed port sends an RST packet in response to the SYN probe, which Nmap interprets as 'closed', not 'filtered'.

Why this answer

How to eliminate wrong answers

Option A is wrong because Maltego is a graphical link analysis tool used for open-source intelligence (OSINT) and relationship mapping between entities (e.g., domains, email addresses, people), not for automating Google dorking queries. Option B is wrong because theHarvester is a tool for gathering email addresses, subdomains, and virtual hosts from public sources like search engines and PGP key servers, but it does not focus on executing Google dork queries to find vulnerable web applications. Option D is wrong because Shodan is a search engine for internet-connected devices (e.g., IoT, servers, webcams) and their banners, not a tool for performing Google dorking against Google's search index.

Why this answer

How to eliminate wrong answers

Option A is wrong because banner grabbing with Telnet requires establishing an active TCP connection to the target, which sends packets and violates the 'no packets sent' constraint. Option C is wrong because querying Shodan is a passive information-gathering method that uses a third-party database, but it does not directly identify the OS of a remote host from the tester's own captured traffic; Shodan may provide OS guesses based on its own active scans, but the question specifies the tester must not send packets, and Shodan's data is not derived from the tester's capture. Option D is wrong because active OS fingerprinting with Nmap -O sends crafted probes (e.g., SYN, FIN, NULL scans) to the target and analyzes responses, which directly contradicts the requirement of not sending any packets.

Why this answer

How to eliminate wrong answers

Option A is wrong because tls-nextprotoneg is used to enumerate TLS next-protocol-negotiation (NPN) support, which is irrelevant to identifying malware or reverse shell traffic. Option B is wrong because smb-enum-shares enumerates SMB shares on Windows systems, which does not apply to HTTPS outbound traffic analysis. Option D is wrong because ssh2-enum-algos enumerates SSH algorithm support, which is unrelated to HTTPS or reverse shell detection.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'filtered' does not imply the port is open; an open port that is not responding would typically be marked as 'open|filtered' if no response is received, not simply 'filtered'. Option B is wrong because an open and actively listening port would be reported as 'open' by Nmap after receiving a SYN/ACK response, not 'filtered'. Option C is wrong because a closed port responds with RST packets, which Nmap reports as 'closed', not 'filtered'; 'filtered' specifically means the probe was dropped or blocked without a TCP-level response.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because hping3 is a packet crafting and testing tool, not optimized for high-speed scanning of large networks; it operates synchronously and is better suited for targeted firewall testing or DoS simulation. Option B is wrong because while Nmap is powerful and versatile, its default scanning methods (e.g., TCP SYN scan) are slower than Masscan on very large subnets due to its sequential or semi-parallel processing overhead and lower default packet rate. Option D is wrong because Wireshark is a packet capture and analysis tool, not a scanning tool; it cannot actively send probes to discover live hosts.

Why this answer

How to eliminate wrong answers

Option A (SYN flood) is wrong because it is a denial-of-service attack that sends a high volume of SYN packets to exhaust target resources, not a reconnaissance technique using a spoofed IP to infer port states. Option B (TCP connect scan) is wrong because it completes the full three-way handshake using the attacker's real IP address, not a spoofed source IP, and is detectable in logs. Option D (Half-open scan) is wrong because it sends a SYN packet with the attacker's own IP, receives a SYN/ACK, and then sends a RST to avoid completing the handshake; it does not use a spoofed IP or a third-party zombie to mask the attacker's identity.

Why this answer

How to eliminate wrong answers

Option A is wrong because sending ICMP echo requests (ping sweeps) involves direct interaction with the target network, which violates the requirement of no direct interaction. Option B is wrong because running a vulnerability scan with Nessus actively probes target systems for weaknesses, generating traffic and direct interaction. Option C is wrong because performing a port scan using Nmap SYN scan sends crafted TCP SYN packets to target hosts, which is an active reconnaissance technique that directly interacts with the target's systems.

Why this answer

How to eliminate wrong answers

Option A is wrong because ping sweeping sends ICMP Echo Request packets to multiple hosts and waits for replies, actively probing the target network. Option B is wrong because banner grabbing with Telnet establishes a TCP connection (port 23 or other) to the target service and reads the initial banner, which is an active interaction. Option C is wrong because running a SYN scan with Nmap sends crafted TCP SYN packets to target ports and analyzes responses, which is an active scanning technique that can be detected by intrusion detection systems.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a UDP scan (-sU) is used to discover UDP services, but reverse shells typically use TCP for reliable communication, and UDP scanning would not effectively identify a TCP-based listening service. Option B is wrong because the http-enum script is designed to enumerate directories and files on HTTP/HTTPS services, but the C2 server may not be running a web service, and this script does not perform general service identification. Option C is wrong because OS fingerprinting (-O) determines the operating system of the target host, not the specific service or application version running on a listening port, which is irrelevant for identifying the C2 service.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'filtered' means the probe was dropped or blocked by a firewall or packet filter (no response or ICMP unreachable), not a TCP RST. Option B is wrong because 'unfiltered' is a special state used only in ACK scans (e.g., -sA) where the port is reachable but its open/closed status cannot be determined; it does not apply to a SYN scan receiving a RST. Option D is wrong because an 'open' port would respond with a SYN-ACK, not a RST.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'filetype:xls username password' targets Excel files that may contain credentials, not login pages. Option B is wrong because 'intitle:"index of"' reveals directory listings (e.g., open Apache indexes), not login pages. Option D is wrong because 'site:example.com intext:password' searches for pages containing the word 'password' in their body text, which could be any page (e.g., password reset forms or help pages), not specifically login pages.

Why this answer

How to eliminate wrong answers

Option A is wrong because the idle scan does not require any specific operating system on the zombie; it works with any host that uses an incremental IP ID sequence (e.g., many legacy Windows, Linux, or BSD systems). Option B is wrong because the attacker does not need root access on the target machine; the scan is performed externally, and root access is only needed on the attacker's machine to send raw packets (e.g., via libpcap). Option D is wrong because the target's operating system or SSH service is irrelevant; the idle scan works against any TCP port on any target, regardless of OS or running services.

Why this answer

How to eliminate wrong answers

Option A is wrong because SNMP community string brute-forcing targets UDP ports 161/162, not TCP port 445. Option C is wrong because HTTP directory traversal exploits web servers on ports 80/443/TCP, not the SMB port. Option D is wrong because DNS cache poisoning attacks target DNS servers on UDP/TCP port 53, not port 445.

Why this answer

How to eliminate wrong answers

Option B is wrong because Maltego is a graphical link analysis tool for gathering and correlating open-source intelligence (OSINT), not a network scanner for live host discovery; it relies on existing data sources rather than sending packets. Option C is wrong because dnsenum is a DNS enumeration tool that queries DNS servers for subdomains and records, not a host discovery scanner; it does not send raw packets to probe IP addresses. Option D is wrong because Nessus is a comprehensive vulnerability scanner that performs deep, multi-packet scans with full handshakes and plugin checks, generating heavy traffic and taking much longer than needed for simple host discovery.

Why this answer

How to eliminate wrong answers

Option B is wrong because `-sT` performs a full TCP connect scan, which completes the three-way handshake and is more likely to be logged by the target system and detected by IDS/IPS due to the completed connections. Option C is wrong because increasing timing to `-T5` sends packets faster, which can actually increase the likelihood of detection by IDS/IPS due to abnormal traffic patterns or rate-based alerts. Option D is wrong because replacing `-sV` with `-sU` changes the scan type to UDP, which does not perform the same service version detection and is not a technique for evading detection; it simply scans different protocols.

Why this answer

How to eliminate wrong answers

Option A is wrong because Shodan does not perform real-time network traffic analysis; it uses periodic, active probing to collect static snapshots of service banners, not live packet captures or flow data. Option B is wrong because passive DNS records and domain registration details are the domain of tools like whois, SecurityTrails, or DNSdumpster, not Shodan—Shodan focuses on IP-level service metadata, not domain-level ownership or DNS history. Option D is wrong because Shodan does not provide historical vulnerability data for each device; while it may show the version of a service, it does not correlate that version with CVE databases or track patch history—that would require a separate vulnerability scanner or a platform like Shodan's own 'Vulnerabilities' feature (which is an add-on, not a core capability).

Why this answer