CEH - Chap 5

1. If you receive a RST packet back from a target host, what do you know about your target?

• A. The target is using UDP rather than TCP.
• B. The destination port is open on the target host.
• C. The source port in the RST message is closed.
• D. The target expects the PSH flag to be set.

2. What is the difference between a SYN scan and a full connect scan?

• A. A SYN scan and a full connect scan are the same.
• B. A full connect scan sends an ACK message first.
• C. A SYN scan uses the PSH flag with the SYN flag.
• D. The SYN scan doesn’t complete the three-way handshake.

3. What is one reason a UDP scan may take longer than a TCP scan of the same host?

• A. UDP will retransmit more.
• B. UDP has more ports to scan.
• C. UDP is a slower protocol.
• D. UDP requires more messages to set up.

4. Why does an ACK scan not indicate clearly that ports are open?

• A. The scanner has to guess.
• B. ACK is not a supported flag.
• C. The target system ignores the message.
• D. ACK scans cause a lot of retransmits.

5. What is one reason for using a scan like an ACK scan?

• A. It may get through firewalls and IDS devices.
• B. It is better supported.
• C. The code in nmap is more robust.
• D. An ACK scan is needed for scripting support.

6. What does nmap look at for fingerprinting an operating system?

• A. The operating system headers
• B. The application version
• C. The response from connecting to port 0
• D. The IP ID field and the initial sequence number

7. What is nmap looking at when it conducts a version scan?

• A. TCP and IP headers
• B. Application banners
• C. Operating system kernel
• D. IP ID and TCP sequence number fields

8. What is an advantage of using masscan over nmap?

• A. masscan has been around longer.
• B. nmap is hard to use.
• C. masscan can scan more addresses faster.
• D. masscan has access to scan more of the Internet.

9. If you were to see hping -S -p 25 10.5.16.2, what would you assume?

• A. Someone was trying to probe the web port of the target.
• B. Someone was trying to probe an email port on the target.
• C. Someone was trying to identify if SNMP was supported on 10.5.16.2.
• D. Someone had mistyped ping.

10. If you were to see that someone was using OpenVAS, followed by Nessus, what might you assume ?

• A. They were trying to break into a system.
• B. They didn’t know how to use Nessus.
• C. They didn’t know how to use OpenVAS.
• D. They were trying to reduce false positives.